Once you’ve installed WordPress in multisite mode. You’ll soon see the screen below when you want to add plugins or themes though the admin area. You can manually enter your FTP credentials each time, or follow this tutorial and enjoy the one-click updates WordPress users are accustomed to.
Your fingers will become fatigued after a round of upgrading.
There’s two steps to this tut. First, create a new user with a it’s own rsa key. This account will only be used for updating WordPress and is named ‘wp-updater’ in this example. Secondly, we’ll add the sftp information to wp-config.
1. Create a new user
Fire up the command line:
groupadd wp-updater
useradd -g wp-updater -d /home/wp-updater -m wp-updater
su wp-updater
ssh-keygen
cp /home/wp-updater/.ssh/id_rsa.pub /home/wp-updater/.ssh/authorized_keys
chmod 755 /home/wp-updater/.ssh
chmod 644 /home/wp-updater/.ssh/*
2. Add upgrade constants to wp-config.php
define('FS_METHOD', 'direct');
define('FS_CHMOD_DIR', 0777);
define('FS_CHMOD_FILE', 0777);
define('FTP_BASE', '/var/www/vhosts/domain.com/httpdocs');
define('FTP_CONTENT_DIR', '/var/www/vhosts/domain.com/httpdocs/wp-content/');
define('FTP_PLUGIN_DIR ', '/var/www/vhosts/domain.com/httpdocs/wp-content/plugins/');
define('FTP_PUBKEY', '/home/wp-updater/.ssh/id_rsa.pub');
define('FTP_PRIKEY', '/home/wp-updater/.ssh/id_rsa');
define('FTP_USER', 'wp-updater');
define('FTP_HOST', '255.255.255.255:22'); // your server's ip
/* That's all, stop editing! Happy blogging. */
You will also want to activate SFTP with the following directive:
define('FTP_SSL', true);
Read more about WordPress Upgrade Constants.
Might also have to manually create your upgrade directory depending on your permission scheme:
cd wp-content
mkdir upgrade
chown apache:apache upgrade
chown apache:ftp plugins -R
Securing
Putting your FTP credentials into a file is generally not a great thing to do. However, the time savings may be with it to you. You can take some additional steps to obscure your wp-config file.
- Move it up a directory – Since WordPress 2.-something you’ve been able to move your wp-config.php up a directory (out of you web root) and WordPress will look for it there. I’ve heard tell of some plugins not complying with this, and if you run into that you can try:
- Puting a PHP include in your wp-config – You can move the ‘meat’ of your wp-config to another file and use a php include() to bring it in to your wp-config.
If someone gets into your wp-config, then all they’ll see is this:
include('/var/www/vhosts/domain.com/filename.php');
/** WordPress likes the language defined here */
define ('WPLANG', '');
/** Absolute path to the WordPress directory. */
if ( !defined('ABSPATH') )
define('ABSPATH', dirname(__FILE__) . '/');
/** Sets up WordPress vars and included files. */
require_once(ABSPATH . 'wp-settings.php');
Hopefully this will help someone.
