Help!
I have volunteered to become webmaster of the National DeSoto Club's website, which is built on Drupal. The website has existed as it is seen today for quite a while. The builder of the site and former webmaster has resigned due to health issues, and has been out of touch for a while so I'm looking for help from other sources.
I restore antique cars..... and know next to nothing about
Drupal.
I'm getting emails from Drupal saying that I need to apply security updates, but don't have a clue on what to do. I can currently log into the site as an administrator, and have managed to accomplish a few things without crashing the whole site, but I really need someone more familiar with Drupal to point me in the right direction.
Thanks in advance for any help
Tim Bowers
620-489-6495
Comments
Welcome my Mopar
Welcome my Mopar brother!
Your number one task right this minute needs to be to make sure you have dealt with the SA-CORE-2014-005 vulnerability. https://www.drupal.org/SA-CORE-2014-005
If your site wasn't upgraded to 7.32 on October 15, 2014, then it is almost certainly compromised.
For a quick overview checkout this video: https://modulesunraveled.com/blog/how-restore-your-hacked-site
Next, module security updates will be the next priority. The site is using Gallery 2 and phpBB integration of some sort, so those will also need attention and probably security attention in addition to Drupal.
I would also recommend subscribing to Drupal Security release emails, which can be done in your profile on Drupal.org. This will give you the quickest access to security issues. When the above vulnerability was discovered the mail list got advanced notice to be ready to act when the patch was released.
Beyond that, what other issues are you facing?
I also maintain a large Mopar community, cbodydrydock.com. It isn't Drupal yet, but will be in the future. Migrating over is a massive job. I will send you my contact info through the contact form on your Drupal.org profile.
I am so embarrassed by how
I am so embarrassed by how quickly my eyes glaze over trying to read these things. It is certainly not my native language....
When my son began aviation school, I immediately realized that the aviation community speaks in acronyms, and that seems to be the same thing with people that are well versed in computers.
"Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks."
Like I said.... I'm so new at this. What's API? What's an SQL? Why would someone attack it?
I thought I was pretty big stuff since I learned how to edit my own website at www.stellarrestorations.com using Adobe Contribute. My experience there is that I know the guy that is hosting my site, and I have Contribute installed on my computer...... but I don't have Drupal installed on my computer, and right now I am logging on to the DeSoto website with a previously created Admin identity. Where is Drupal? I've tried to download the updates, but then I can't open anything that's been downloaded, and I can't figure out what I would do with it even if I could.
When logged in, I have a menu across the top of the website page that has dropped downs that read from left to right "Content Management" "Site Building" "Site Configuration" "Store Administration" "User Management" "Reports" "Advanced Help" "Help"
I've discovered on my own how to create new user accounts, I've changed some text documents, I even changed out an annoying GIF that was the welcome banner on the home page to a different annoying GIF. I really thought I was on my way.
Thanks for responding to my initial cry for help, HaloFX. I received your email as well. I'll check your recommended links out. However, I really feel lost on some of these capabilities since I'm not understanding some things that are probably very basic in nature to those of you that are much more accomplished.
Tim
Jumping in feet first with no
Jumping in feet first with no background on an existing site is going to be an overwhelming experience, although not impossible. You aren't going to need to be proficient with Drupal APIs or really deal directly with SQL much. But you will need to quickly get up to speed with tools like FTP, the command line, and at some point GIT would be very helpful. You are going to need to use FTP to upload files, and the command line to directly manipulate files. GIT is a version control system.
Largely a lot is going to depend on what you want to accomplish. Do you really want to learn what it takes to maintain a Drupal site at its core level? And dedicate the time? Seeing as you already have a full time career, I would highly recommend you find someone to handle this low level stuff, and focus on the content and users of the site. Honestly, you are staring down a huge rabbit hole.
I am in the same position from the opposite direction. I choose the web as my career path 20 yrs ago, but was raised as a DIYer and gearhead. My baby is a 69 Plymouth that I had professionally restored, and heavily modified. While I did do a fair amount of the mechanics, I left the paint and body to the pro. Since then I have almost completed a 70 PowerWagon on my own. The difference in quality is obvious, despite my best efforts and access to professional tools and a paint booth. As you know, experience can't be replaced.
Whew..... that wasn't an
Whew..... that wasn't an encouraging read!
You're correct that time is precious and I wasn't necessarily looking for a huge learning curve when I volunteered for the NDC.
I guess I need to do some soul-searching. Except I don't know anybody to do the low level stuff, and even the former builder of the site/webmaster isn't returning my emails, and I've heard from others that he is back from whatever exile he was experiencing.
Rats.
Tim
Yeah, sorry. I realized it
Yeah, sorry. I realized it was pretty direct right after I posted it, but I have had multiple clients over the years go down similar holes and totally lose focus on either their core business, or on want they were really trying to accomplish. They got so close to the technical side, spending way too many hours learning HTML, CSS, messing with Photoshop and such, when all they really wanted was a way to change some text. Drupal has considerably more distractions. Once a database is introduced, the complexity and security implications ramp up quickly.
Looks like you are hosting on Goddady, which isn't doing you any favors. A host like Pantheon can at least make applying core updates quick and simple. Odds are that will cost a bit more money.
You certainly are welcome to ask any questions here, or even to me, if you want to. Drupal is pretty awesome, this is why I shifted my business entirely over Drupal several years ago. I am a bit over 7 years into Drupal, and still always learning, experimenting, and occasionally banging my head on the desk.
No need to apologize. I
No need to apologize. I wasn't offended, but you made me weary, lol. Dang it, you mean I have to learn something?
I appreciate your comments. Like many, if not most car clubs, the NDC relies on volunteerism within the club to accomplish the Board of Trustees, the magazine, the club store, the website, et al. For instance a decision to go with GoDaddy in the past may have been driven by budget concerns, or the preferences of the original builder of the site....not necessarily considering the full range of service a host may offer.... I threw my name into the hat as the only person showing interest in the webmaster task out of 1) interest and 2)nobody else was stepping up.
My most immediate concern is born out of your initial comments regarding applying the security updates, and your terminology about the site being "most certainly compromised". That sounds scary in todays lingo of identity protection, etc. And I get emails from Drupal daily telling me that there are updates. If I can get over that hump, then my anxiety level goes down and I can go back to poking around the site and learning stuff at that level.
Maybe this weekend I can get to exploring the links you provided earlier. Then I'll probably be back with either good news, or an even more confused look on my face.
Have a great weekend!
Tim
Definitely watch the video.
Definitely watch the video. Brian does a good job of explaining how to tell if you are compromised in easy to understand terms. The big give away will be a user with Admin rights that shouldn't be there.
I understand where you are coming from, that is how I got the C-Body site. The guy running it was done and was looking for someone to take over, and I was the only one in the group with any background at all.