reddyweb

#!/bin/bash
set -euo pipefail
IFS=$'\n\t'

# Ubuntu 16.04 Dev Server
# Run like - bash install_lamp.sh
# Script should auto terminate on errors

echo -e "\e[96m Adding PPA  \e[39m"
sudo add-apt-repository -y ppa:ondrej/apache2

reddyweb

#!/bin/bash
# Based on https://www.drupal.org/node/244924

# Disable PHP insecure functions
disable_sys_funcs() {
	printf "\nDisabling PHP Dangerous/Insecure Functions ...\n"

	funcs_to_disable="apache_child_terminate, apache_setenv, define_syslog_variables, escapeshellarg, escapeshellcmd, eval, exec, fp, fput, ftp_connect, ftp_exec, ftp_get, ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist, highlight_file, ini_alter, ini_get_all, ini_restore, inject_code, mysql_pconnect, openlog, passthru, php_uname, phpAds_remoteInfo, phpAds_XmlRpc, phpAds_xmlrpcDecode, phpAds_xmlrpcEncode, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, posix_setuid, posix_uname, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, shell_exec, syslog, system, xmlrpc_entity_decode"

	PHP_ini=$(find /etc/ -name php.ini 2>&1 | grep apache)

reddyweb

# prevent site fingerprinting via release related files
<FilesMatch "(^API|CHANGELOG|COPYRIGHT|INSTALL|LICENSE|PATCHES|MAINTAINERS|README|TODO|UPGRADE|UPDATE|update|install|authorize).*\.(md|txt|php)$">
  Order deny,allow
  Deny from all
</FilesMatch>

reddyweb

# Ignore directories generated by Composer
/drush/contrib/
/vendor/*

# Ignore sensitive information
/web/sites/*/settings*.php
/web/sites/*/services*.yml

# Ignore Drupal's file directory
/web/sites/*/files/

reddyweb

Drupal 8 Securing Production Environment

Permissions

sudo chown -R MYUSER:www-data *
sudo find . -type d -exec chmod 755 {} \;
sudo find . -type f -exec chmod 640 {} \;
sudo find sites/default/files/config* -type f -exec chmod 664 {} \;

reddyweb

# keep .htaccess under wp-admin folder, and .htpasswd under project root folder
#example test credentials: admin:admin

SetEnvIf Request_URI ^/path/to/project/root/folder/wp-admin/admin-ajax.php noauth=1
Authtype Basic
AuthName "Restricted Access"
AuthUserFile /path/to/project/root/folder/.htpasswd
Require valid-user
Order Deny,Allow
Deny from all

reddyweb

# Git: Feature Branch Flow

git checkout master
git checkout -b develop
git checkout -b feature_branch
#work happens on feature branch
git checkout develop
git merge feature_branch

reddyweb

Command line instructions

Git global setup

git config --global user.name "NAME"
git config --global user.email "example@gmail.com"

Create a new repository

reddyweb

Redirect all traffic from http:// to https://

• Below both are working fine, so choose any 1 option.

Option 1:

• In .htaccess file, add below lines right after "RewriteEngine on"

 # Force redirect to HTTPS

reddyweb

# Map files directory with produciton
RewriteRule ^sites/default/files/styles(.*)$ http://exampledomain.com/sites/default/files/styles/$1 [R=301,NC,L]
RewriteRule ^sites/default/files(.*)$ http://exampledomain.com/sites/default/files/$1 [R=301,NC,L]