1

I am having multiple wordpress sites with multiple users working on those.

Therefore I would like to centeralize the user management, by having one authentication server, storing the username, password and website this user can access. This way i can easily e.g. reset passwords in one place instead of having to go through all websites one by one

**Each website will get a wordpress plugin which works the following way: a user logs in -> plugin intercepts the login and sends a curl request via tls to the authentication server -> this server checks the authentication and authorization and returns true or false.

The authentication server will have a common WAF and only the known servers whitelisted in iptables. Additionally, when installing the plugins, there is a pair of keys generated which have to be inserted on the wordpress end. Using the key the communication between wordpress and authentication server is additionally encrypted (in case there is a man in the middle despite the tls)**

With a setup like this, are there any obvious vulnerabilites that i have overseen ?

Thanks for any input

Improve this question
2
  • 1
    Questions that can be summed up as "Here's a complex system that I came up with, are there any security issues with it?" tend to have two answers: Either "yes" or "probably." (If you want a mansplained version of best practices (which may not actually be a good practice -- for example, a common mansplained bit of advice on passwords is to expire them every 90 days), you can always say something that is obviously wrong to experts, and people will leap to an explanation. This is called the Mandelbrot Effect.) – Ghedipunk Nov 25 '19 at 20:09
  • 1
    @Ghedipunk heh - want to create a canonical question for your comment? (run it by meta, though) – schroeder♦ Nov 25 '19 at 21:54
1

Create a LDAP server for setting up the users and then use one of the multiple wordpress ldap plugins to handle the authentication.

Improve this answer
0

Rather than roll your own complex and possibly flawed setup. It sounds like you are looking for a secrets manager.

Secrets management tools allow organisations or groups to centrally manage secrets (keys, passwords, certificates) as well as offer access control and many other security features.

The benefit of using a secrets management tool in your case, is that the developers never see or know the plain text passwords for access, they log into the secrets management tool and launch the WordPress site they are working on from there.

From your perspective you can control which users have access to which WordPress sites. Depending on the Secrets Management tool selected, it could automatically reset the WordPress passwords after use, have concurrent usage locks (so a site can only be worked on by X concurrent developers) etc.

There are plenty of both paid and open source tools, these tools also often come with Privileged Access Management features, Role Based Access Control, account life cycle management (Automatically change passwords based on rule), monitoring and auditing, MFA (to otherwise non-MFA configured products), session recording, SecDevOps, Conditional Access rules.

You will need to do some research and testing to see which one meets your specific needs.

Note: I am not affiliated with any Secrets Management companies. They are just something I personally use in my own teams.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.