Here's a little trick to protect your admin folder

[php_Guy]

Here is something I came up with to protect my admin folder. I thought I'd share it here.

 

Create an .htaccess file in your admin directory with the following:

# Deny access to everyone except for my IP
Order Deny,Allow
Deny from all
Allow from xx.xx.xx.xx

where xx.xx.xx.xx is your IP address

 

If you work from various IPs or if other people need access just add more Allow from lines.

 

If anyone knows of a vulnerability to this script please post it here.

 

Enjoy!

[mme]

This is a good method but some (if not most) have dynamic ip addresses so this wont be that helpful for them as they would have to change the .htaccess each time they get a new IP address.

[php_Guy]

This is a good method but some (if not most) have dynamic ip addresses so this wont be that helpful for them as they would have to change the .htaccess each time they get a new IP address.

 

The website will be on a dynamic IP (unless they paid for a dedicated one) but the IP in question would be the one they are using to "dial in" from. The cable modem I'm attached to at home (or is it my router?) has a static IP so allowing that IP will always allow me to get in from home. If I wanted to connect from work, I would have to allow that IP as well.

[mme]

The website will be on a dynamic IP (unless they paid for a dedicated one) but the IP in question would be the one they are using to "dial in" from. The cable modem I'm attached to at home (or is it my router?) has a static IP so allowing that IP will always allow me to get in from home. If I wanted to connect from work, I would have to allow that IP as well.

 

Yes however most people have a dynamic IP (the one they "dial in" from) that changes daily if not more often.

[php_Guy]

Yes however most people have a dynamic IP (the one they "dial in" from) that changes daily if not more often.

 

Oh, I did not realize that. Bummer :(

 

I'm so glad mine is static.

[Robbogeordie]

If you're on a dynamic IP like me then you may notice that the first 5 or 6 numbers will often be the same. The other numbers will change.

Then you may get a completely different IP ,but again the first 5 or 6 numbers will always be the same. This is how mine works anyway and I have 2 base addresses- it may be different for you.

If you regularly check your IP you will be able to clarify this yourself - may be different for you,but this is how it is for me.

Then just use the above .htaccess code, but use the first 5 or 6 numbers of your IPs .

OK, it's not as secure as if you had a static IP,but some of us don't have that option and this way should exclude 99% of the worlds population.

Works for me anyway.

If you end up blocking yourself simply check your IP and upload a new .htaccess

[Guest]

Here is something I came up with to protect my admin folder. I thought I'd share it here.

 

Create an .htaccess file in your admin directory with the following:

# Deny access to everyone except for my IP
Order Deny,Allow
Deny from all
Allow from xx.xx.xx.xx

where xx.xx.xx.xx is your IP address

 

If you work from various IPs or if other people need access just add more Allow from lines.

 

If anyone knows of a vulnerability to this script please post it here.

 

Enjoy!

You might want to add a username and password after reading this:

http://www.sans.org/reading_room/whitepapers/threats/959.php

[php_Guy]

You might want to add a username and password after reading this:

http://www.sans.org/reading_room/whitepapers/threats/959.php

 

<sigh> I did not want to hear that :(

 

I don't know how common IP spoofing attacks are against small stores but I'm glad I know about it now. Thanks for posting that.

[shooter-boy]

Yeah it's a good safety measure, but should be used in addition to, not instead of a htaccess or RC1+ admin login.

 

Rob

[Guest]

Best admin folder protection method you can do is:

 

- rename the folder from "admin" to something else

- password protect the directory from your web hosting control panel/.htpasswd

[Guest]

Best admin folder protection method you can do is:

 

- rename the folder from "admin" to something else

- password protect the directory from your web hosting control panel/.htpasswd

If you change the name of the admin folder, do you have to change anything in configuration files?

[jordan]

If you change the name of the admin folder, do you have to change anything in configuration files?

You will need to change the admin/includes/configure.php file so that the new admin folder name is replaced where it mentions the path to admin.

 

Hope this helps

[Guest]

^^^ what he said. :)

[mido82]

You will need to change the admin/includes/configure.php file so that the new admin folder name is replaced where it mentions the path to admin.

 

Hope this helps

 

hi. i am not very good at this, but i have searched for the place where the path is mentioned, but i cant find it in root/admin/includes/configuration.php

 

and neither in the

 

root/includes/configure.php

 

can you help me find it

 

thank you very much

[spooks]

you can't find the files???

[mido82]

you can't find the files???

 

i am not which file it is but i have tried these ones

 

root/includes/configure.php

 

root/admin/includes/configuration.php

 

i guess i should be in admin since its the admin option we are editting. but i cant find the place in the file where i should edit the path to the admin folder.

 

 

thank you

[Guest]

hi. i am not very good at this, but i have searched for the place where the path is mentioned, but i cant find it in root/admin/includes/configuration.php

 

and neither in the

 

root/includes/configure.php

 

can you help me find it

 

thank you very much

root/admin/includes/configure.php

[mido82]

root/admin/includes/configure.php

 

ok. thank you very much.

 

now where in this file do i change the path?

 

:D

 

if you can help me with this, you will be the greatest. thank you

[mido82]

ok. thank you very much.

 

now where in this file do i change the path?

 

:D

 

if you can help me with this, you will be the greatest. thank you

 

 

ok i got it now.

 

thank you very much all

[helixia]

I don't know how to protect admin?

 

In /public_html/admin/includes/configure.php, I see

define('DIR_WS_ADMIN', '/admin/');

define('DIR_FS_ADMIN', '/home/xxx/public_html/admin/');

which one do I change and how?

 

After that, do I need to change /public_html/admin/ to /public_html/newdirectory/ ?

Well, if so, will I need to change all my addon?

[helixia]

It is ok now. I have successfully done it.

[PhpNurd]

Here is something I came up with to protect my admin folder. I thought I'd share it here.

 

Create an .htaccess file in your admin directory with the following:

# Deny access to everyone except for my IP
Order Deny,Allow
Deny from all
Allow from xx.xx.xx.xx

where xx.xx.xx.xx is your IP address

 

If you work from various IPs or if other people need access just add more Allow from lines.

 

If anyone knows of a vulnerability to this script please post it here.

 

Enjoy!

 

 

This is good. Thanks

[airbrushmaster]

This is good. Thanks

 

 

this as lost me can some tell me in detail what you have to do as wheni went in admin/includes/configure.php there was about 6 things saying admin

[Guest]

this as lost me can some tell me in detail what you have to do as wheni went in admin/includes/configure.php there was about 6 things saying admin

.htaccess file not configure.php

[airbrushmaster]

.htaccess file not configure.php

 

i have added the bits to htaccess but it says on here you have to do others