0

We are having issue with the 'BRUTEFORCE ATTACK ?' option in magereport.

We are trying to install the 8788 patch on website. Was successfully able to install the 8788 patches on the website but not able to fix the 'BRUTEFORCE' option mentioned in magereport. The .htaccess rules are working on normal linux servers and also plesk servers but we are having issues with the same rule on Cpanel server's.

We have tried all the possible combinations to fix the error but this is still showing. Do any one have an idea on this? Why is the error still showing where as the same rule works on plesk/No interface server while it is not working on a Cpanel server? Please let us know.

Below rule is used.

Please note - both downloader and admin url is renamed.

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]
RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php?)?rss/ - [L,R=403]
3

What does Magereport check for?

Magereport checks these URL’s:

/index.phprss/catalog/notifystock/ (yes, without the slash) /admin /downloader An error is raised, when an admin/downloader login screen is found, or a basic auth dialogue (on rss).

see the below links for more information: https://support.hypernode.com/knowledgebase/how-to-protect-your-magento-store-against-brute-force/

https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

3

Protect your Magento Store to Brute force attacks. Follow following step.

Apache Server Users

To whitelist an IP address for the admin panel, add the following rule in root .htaccess file (inside <IfModule mod_rewrite.c>)

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

To whitelist an IP address for the RSS feed, add the following rule in the root .htaccess file (inside <IfModule mod_rewrite.c>):

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]

To whitelist an IP address for the downloader application, add the following rule in ./downloader/.htaccess file:

order deny,allow
deny from all
allow from xx.xx.xx.xx

Hope It's helpful for any one..Thank You

1

In the place you put above code, please add below one and try again.

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] 

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=302,L] 
  • where i will add? – Nadh Apr 24 '17 at 11:17
  • in the .htaccess file just below mode rewrite. – Shyam Krishna Sreekumar Apr 25 '17 at 15:16
  • but its not working @shyam – Nadh Apr 26 '17 at 13:14
  • just add below <IfModule mod_rewrite.c> it should work – Shyam Krishna Sreekumar May 2 '17 at 12:16
1

I was getting same issue and i have fixed it by using these rule in root .htaccess file.

Note: it should be written before enable rewrites code RewriteEngine on

<IfModule mod_rewrite.c>


RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/catalog/notifystock|rss/catalog/notifystock|index.php/rss/order|rss/catalog|rss/order).*$ / [R=301,L,NC]

RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xxx.xxx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xxx.xxx
RewriteRule ^(index.php/)?downloader/ - [L,R=403]


</IfModule>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.