0

We are having issue with the 'BRUTEFORCE ATTACK ?' option in magereport.

We are trying to install the 8788 patch on website. Was successfully able to install the 8788 patches on the website but not able to fix the 'BRUTEFORCE' option mentioned in magereport. The .htaccess rules are working on normal linux servers and also plesk servers but we are having issues with the same rule on Cpanel server's.

We have tried all the possible combinations to fix the error but this is still showing. Do any one have an idea on this? Why is the error still showing where as the same rule works on plesk/No interface server while it is not working on a Cpanel server? Please let us know.

Below rule is used.

Please note - both downloader and admin url is renamed.

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]
RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php?)?rss/ - [L,R=403]

4 Answers 4

3

What does Magereport check for?

Magereport checks these URL’s:

/index.phprss/catalog/notifystock/ (yes, without the slash) /admin /downloader An error is raised, when an admin/downloader login screen is found, or a basic auth dialogue (on rss).

see the below links for more information: https://support.hypernode.com/knowledgebase/how-to-protect-your-magento-store-against-brute-force/

https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

1
  • These things i already know. Please see my exact issue above. Commented Nov 8, 2016 at 7:01
3

In the place you put above code, please add below one and try again.

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] 

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=302,L] 
4
  • where i will add?
    – User0434
    Commented Apr 24, 2017 at 11:17
  • in the .htaccess file just below mode rewrite. Commented Apr 25, 2017 at 15:16
  • but its not working @shyam
    – User0434
    Commented Apr 26, 2017 at 13:14
  • just add below <IfModule mod_rewrite.c> it should work Commented May 2, 2017 at 12:16
3

Protect your Magento Store to Brute force attacks. Follow following step.

Apache Server Users

To whitelist an IP address for the admin panel, add the following rule in root .htaccess file (inside <IfModule mod_rewrite.c>)

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

To whitelist an IP address for the RSS feed, add the following rule in the root .htaccess file (inside <IfModule mod_rewrite.c>):

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]

To whitelist an IP address for the downloader application, add the following rule in ./downloader/.htaccess file:

order deny,allow
deny from all
allow from xx.xx.xx.xx

Hope It's helpful for any one..Thank You

2

I was getting same issue and i have fixed it by using these rule in root .htaccess file.

Note: it should be written before enable rewrites code RewriteEngine on

<IfModule mod_rewrite.c>


RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/catalog/notifystock|rss/catalog/notifystock|index.php/rss/order|rss/catalog|rss/order).*$ / [R=301,L,NC]

RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xxx.xxx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xxx.xxx
RewriteRule ^(index.php/)?downloader/ - [L,R=403]


</IfModule>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.