0

We have a magento server up and running. The server had the default 'admin' url which was then changed to some random string for security purpose, which only our team knows. Now we also have an admin monitoring system and log to monitor failed login attempts. The log shows multiple attempts to login into the admin dashboard. My question is, how the admin url gets leaked to the outside world. We have changed the admin urls several times. Even then, how does outsiders find our admin url ? Or Is it possible to find the admin url through the website's frontend ?

0

I'm not a hacker and am not quite sure how other than brute force or vulnerabilities in the computers and networks accessing this admin path would cause this. It certainly shouldn't be visible however if all default .htaccess files are present and in tact. The location where this is stored however is app/etc/local.xml from your root and www.yourdomain.com/app/etc/local.xml certainly shouldn't be visible as also contains your database user and password.

You should however lock down admin so only certain IP's can access it. If anyone else needs to access you can add a secure VPN into the network with access so only one IP has access.

Add the below to .htaccess within root of magento installation within IfModule mod_rewrite.c node, replacing admin with your admin URL:

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

Other Places to restrict

Downloader is also an area you should not forget to restrict as well as RSS.

To whitelist an IP address for the RSS feed, add the following rule in the root .htaccess file (inside IfModule mod_rewrite.c again):

RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]

To whitelist an IP address for the downloader application, add the following rule in downloader/.htaccess file:

order deny,allow
deny from all
allow from xx.xx.xx.xx

I will often even move downloader out of the Magento root in production environments.

Note: The above is for a LAMP stack if using NGINX or if you want some more information about where I got this information from see below:

https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.