Can Magmi be installed outwith your site root directory?

Question

Does Magmi have to be unzipped and installed in the root folder? Experimenting with moving all files to a sub folder for added security really. The theory behind this is it is very easy for somebody to establish your store is Magento, and easy then to navigate to the magmi url and play about with existing import files sitting. I've tried moving it to a sub folder, but receiving numerous errors, managed to work through a few, such as permission issues on some folders/files, but the likes of below I can't work out:

fopen(/var/www/vhosts/domain.com/httpdocs/magmi/state/magmistate) [function.fopen]: failed to open stream: No such file or directory in /var/www/vhosts/domain.com/httpdocs/magmi/inc/magmi_statemanager.php on line 45

or when trying to save the DB details:

Warning: require_once(properties.php) [function.require-once]: failed to open stream: No such file or directory in /var/www/vhosts/domain.com/httpdocs/magmi/inc/magmi_config.php on line 2

Any ideas if I'm flogging a dead horse here?

Answer 1

While moving the magmi utility outside the doc root helps protect its folder structure, it doesn't protect any publicly exposed URLs used in its functions. Moving its folders is one of two steps that need to be done to protect yourself from unauthorized access.

The best way to handle any Magento administrative type functions you wish to use is to have a couple home bases with fixed ip addresses and then do an absolute lockdown on the URLs via .htaccess.

###############################
# Protect /admin/

RewriteCond %{REQUEST_URI} ^/downloader/index.php(.*) [NC]
RewriteCond %{REMOTE_ADDR} !^10\.0\.0\.100
RewriteCond %{REMOTE_ADDR} !^44\.44\.44\.44
RewriteCond %{REMOTE_ADDR} !^88\.88\.88\.88
RewriteRule .* - [F,L]

RewriteCond %{REQUEST_URI} ^/index.php/admin(.*) [NC] 
RewriteCond %{REMOTE_ADDR} !^10\.0\.0\.100
RewriteCond %{REMOTE_ADDR} !^44\.44\.44\.44
RewriteCond %{REMOTE_ADDR} !^88\.88\.88\.88
RewriteRule .* - [F,L]

Add a rule that works for your magmi URL that locks everyone out and then add your fixed IP. Now everyone gets 403 except authorized access. Add the equivalent of netblocks by dropping the last quad.

Note: It's been a while since I've worked with Magmi, so I don't know if it has a web interface, the .htaccess recommendations are to lock down that interface.

Answer 2

You should be able to.

Are you setting the correct path to Magento in your Magmi settings?

By the way, moving it to a different directory isn't going to stop anyone from accessing it. It's still publicly accessible, even though it's a bit more difficult to find.