for U in adam baker charlie delta; do
  DB="${U}_wordpress"
  echo "Database: $DB"
  sudo -H mysql -D $DB -e "
    SELECT u.user_login, u.user_registered, um.meta_value
    FROM wp_users u INNER JOIN wp_usermeta um ON (u.id = um.user_id)
    WHERE um.meta_key = 'wp_capabilities'
    ORDER BY u.user_registered DESC"
  echo ""
done


The output will show the most recently created user accounts for each WordPress installation. Apparently the current worm creates an administrator account called “Administrator (2)” that is used to login and make changes to the site. I don’t know if that string appears in the nickname field, or what, so I didn’t query for it explicitly.

The solution was to remove the CSS comments in the stylesheet. I don’t know why this would cause trouble at the web server level. Makes no sense.

/* -------------------------------------------------------------*/
/* ---->>> thickbox specific link and font settings <<<---------*/
/* -------------------------------------------------------------*/
...
/* -------------------------------------------------------------*/
/* ---->> thickbox settings <<<---------------------------------*/
/* -------------------------------------------------------------*/
...

cd ~/src
wget http://wordpress.org/latest.tar.gz
tar -zxf wordpress-*.tar.gz
rsync -niruW wordpress/ ~/websites/sneakybastard.com/
# looks reasonable, run it
rsync -ruW wordpress/ ~/websites/sneakybastard.com/


The -n options it to perform a dry-run. I like to see what it plans to do before committing. It’s not a bad idea to clean up the permissions on the wp-content directory too.

cd ~/websites/sneakybastard.com
sudo chown -R slappy wp-content
sudo chgrp -R apache wp-content
sudo find wp-content -type d -exec chmod 2775 {} \;
sudo find wp-content -type f -exec chmod 0664 {} \;


The permissions allow file uploads through PHP as the apache user, while the shell account user can make changes to theme and plugin files.