Restrict administrator login to IP range?

Get help with installation and running PivotX 2.0.x here. Please do not post Extension or Theme related questions here.

Restrict administrator login to IP range?

Postby Kyle » Wed Feb 16, 2011 9:17 pm

Due to the recent vulnerabilities (my site was hacked to by some lame little kiddie) I was hoping to lock down access somewhat.

Is there a way to restrict the administrator login to an IP range? Or perhaps disable logins altogether? I'm lucky enough to have completely separated internal and external networks, and I wouldn't mind updating the site only in the internal network, then syncing the site out to the external network, disabling all logins/modifications at that point.

Any way to do this?
Kyle
 
Posts: 1
Joined: Wed Feb 16, 2011 9:12 pm

Re: Restrict administrator login to IP range?

Postby hansfn » Wed Feb 16, 2011 10:54 pm

Yes.

Inside the pivotx directory create a .htaccess file that contains:

Code: Select all
<Files index.php>
    Order allow,deny
    Allow from YOUR-IP
</Files>

If you have turned on "Use Minify in Frontend", you need to make sure that everyone can access pivotx/includes/minify/index.php
hansfn
Developer
 
Posts: 3282
Joined: Sun Nov 25, 2007 7:48 pm
Location: Molde, Norway

Re: Restrict administrator login to IP range?

Postby bavatar » Thu Feb 17, 2011 8:14 am

I did this with the result that the CSS files are not loaded. I've therefore switched to the Limit clause for the .htaccess file

Code: Select all
<Limit POST>
    order deny,allow
    deny from all
    allow from YOUR-IP
    Satisfy all
</Limit>


Which seems to work, but I'm open for better suggestions.

If you don't have a fix IP you can also use a something like 192.168.0 as YOUR-IP to allow access from all IPs in that range.
bavatar
 
Posts: 8
Joined: Sun May 03, 2009 10:51 am

Re: Restrict administrator login to IP range?

Postby hansfn » Thu Feb 17, 2011 8:34 am

bavatar wrote:I did this with the result that the CSS files are not loaded.

Which I already warned you about:
hansfn wrote:If you have turned on "Use Minify in Frontend", you need to make sure that everyone can access pivotx/includes/minify/index.php
hansfn
Developer
 
Posts: 3282
Joined: Sun Nov 25, 2007 7:48 pm
Location: Molde, Norway

Re: Restrict administrator login to IP range?

Postby bavatar » Thu Feb 17, 2011 8:50 am

I was not aware that I'm using it - when did I activate it??? but you are right hans ;-)
bavatar
 
Posts: 8
Joined: Sun May 03, 2009 10:51 am


Return to 2.x Support Forum

Who is online

Users browsing this forum: No registered users and 11 guests

cron