delete admin users automatically in turdpress

So, Turdpress (aka wordpress) randomly gets hacker users added to the list of admin users.

This sucks.

Hence it is called Turdpress.

To fix: 

Make a folder, something like /scripts/

mkdir /scripts

inside there make two shell scripts, call them delete.sh and run_sql.sh

set up a user, e.g. john, to automatically run mysql as root without authentication (obviously put a strong password on that user). 

mysql_config_editor set --host=localhost --user=john --password

mysql_config_editor set --host=localhost --user=root --password

Script: run_sql.sh

#!/bin/sh
if [ -z "`cat $1 | grep -i drop `" ] ; then
su - john -c mysql < $1
else
echo "Dont like that sql, bye"

fi

Script: delete.sh

#!/bin/sh
for i in cat list.txt ; do (
echo $i
cat delete.sql | sed -e s/xxx/$i/g > /tmp/delete-$i.sql 
sh run_sql.sh /tmp/delete-$i.sql
rm /tmp/delete-$i.sql
) ; done

Now make the basic SQL commands to run. In this SQL, leave the xxx in place but replace #1, #2, etc., with the ID numbers of your admin users stored in wp_users.

SQL file delete.sql:

use xxx
delete from xxx.wp_users where ID not in (1,#1,#2,...);

The script replaces xxx with the name/s of all your wordpress site databases.

Now make a list of your wordpress sites:

echo "show databases" | mysql -u root -p > list.txt

This will create a list of databases. Edit the list and remove those which are not wordpress.

List of databases list.txt:

wp_database1 
wp_site2
wp_site3 
wp_database2 

Lastly

run crontab -e and add a cron job so the script runs daily. This will effectively delete all unidentified users in all wordpress databases. The below syntax runs at 6:01 pm every day.

1 18 * * * /scripts/delete.sh