Please provide more detail on how to "Close access to your AdminCP using .htaccess."

[RILLC]

I am trying to make sure all of the steps explained here are followed. However, because I'm not a techy, am not sure I understand this part.

"Close access to your AdminCP using .htaccess. Use either user authorization with a different username and password or IP address restrictions."

Please provide the steps necessary to do this.

Thanks.

[Ion Saliu]

Axiomatic Colleague of Mine:

I always hear in these forums the advice from vB that the customers add .htaccess to the folders of their forums. Is it so hard for vBulletin team itself to add such .htaccess files to important folders of the installation?

.htaccess is actually a complicated matter, that’s why the vBulletin guys are so evasive about this Apache-only feature. There are many pundits who advise strongly against the usage of .htaccess. It does affect server performance and it is not as secure as people would expect. As I’ve said in several posts after the Psychosama hack (August 2013), my website and forum have had plenty of .htaccess files in several directories. Still, my forum was hacked — but not the rest of my website!

From:

http://www.htaccess-guide.com/password-protection/

“To begin, decide which directory you would like to password protect (note that all files and subdirectories within the directory will be password protected), then create a .htaccess file following the main instructions and guidance which includes the following text:

AuthName "Member's Area Name"
AuthUserFile /path/to/password/file/.htpasswd
AuthType Basic
require valid-user

The first line tells the Apache Web Server the secure directory is called 'Member's Area Name', this will be displayed when the pop-up login prompt appears. The second line specifies the location of the password file. The third line specifies the authentication type, in this example we are using 'Basic' because we are using basic HTTP authentication and finally the fourth line specifies that we require valid login credentials, this line can also be used to specify a specific username, e.g. 'require user username' would require the username 'username'. You would use this if you were password protecting an administration area, rather than setting up a public password protected directory.

AuthName "Member's Area Name"
AuthUserFile /path/to/password/file/.htpasswd
AuthType Basic
require valid-user”

You can make the operation a lot easier in your webhost AdminControlPanel. Every webmaster should have such a control panel. So, in my case, I go to the File Manager in my webhosting account. I select the folder (e.g. /forums/admincp) and select the Security (or Protection, etc.) tab. I select Password Protection. I select a username different from the username of my forum admin. I generate a strong password (e.g. in LastPass password manager) – the password is different from the password of my forum admin.

Best of luck and holiday wishes to you all, brothers and sisters in forum administration!


Ion Saliu
Wishful Thinker At-Large
“A good man is an axiomatic man; an axiomatic man is a happy man. Be axiomatic!”

[donald1234]

Axiomatic Colleague of Mine:

I always hear in these forums the advice from vB that the customers add .htaccess to the folders of their forums. Is it so hard for vBulletin team itself to add such .htaccess files to important folders of the installation?

.htaccess is actually a complicated matter, that’s why the vBulletin guys are so evasive about this Apache-only feature. There are many pundits who advise strongly against the usage of .htaccess. It does affect server performance and it is not as secure as people would expect. As I’ve said in several posts after the Psychosama hack (August 2013), my website and forum have had plenty of .htaccess files in several directories. Still, my forum was hacked — but not the rest of my website!

From:

http://www.htaccess-guide.com/password-protection/

“To begin, decide which directory you would like to password protect (note that all files and subdirectories within the directory will be password protected), then create a .htaccess file following the main instructions and guidance which includes the following text:

AuthName "Member's Area Name"
AuthUserFile /path/to/password/file/.htpasswd
AuthType Basic
require valid-user

The first line tells the Apache Web Server the secure directory is called 'Member's Area Name', this will be displayed when the pop-up login prompt appears. The second line specifies the location of the password file. The third line specifies the authentication type, in this example we are using 'Basic' because we are using basic HTTP authentication and finally the fourth line specifies that we require valid login credentials, this line can also be used to specify a specific username, e.g. 'require user username' would require the username 'username'. You would use this if you were password protecting an administration area, rather than setting up a public password protected directory.

AuthName "Member's Area Name"
AuthUserFile /path/to/password/file/.htpasswd
AuthType Basic
require valid-user”

You can make the operation a lot easier in your webhost AdminControlPanel. Every webmaster should have such a control panel. So, in my case, I go to the File Manager in my webhosting account. I select the folder (e.g. /forums/admincp) and select the Security (or Protection, etc.) tab. I select Password Protection. I select a username different from the username of my forum admin. I generate a strong password (e.g. in LastPass password manager) – the password is different from the password of my forum admin.

Best of luck and holiday wishes to you all, brothers and sisters in forum administration!


Ion Saliu
Wishful Thinker At-Large
“A good man is an axiomatic man; an axiomatic man is a happy man. Be axiomatic!”

The other side to that story is that my forum was hit by the rougue admin/install folder exploit but no damage was done as my admincp was protected behind an IP based .htaccess file.

[BirdOPrey5]

Hello,

Here are various ways to protect directories based on the server you have. It is absolutely a good idea to do this, as long as it is done right. If you have cpanel, yes those instructions, they are the easiest.

Protecting a directory with .htacces:
http://www.addedbytes.com/blog/code/...with-htaccess/

Protecting a directory in cPanel:
http://docs.cpanel.net/twiki/bin/vie...ectDirectories

Protecting a directory in Plesk:
http://www.hosting.com/support/plesk...y-in-plesk-10/

Protecting a directory in IIS:
http://www.iis.net/configreference/s.../authorization

Protecting a directory in NGINX:

http://nginxlibrary.com/password-protect-a-directory/

[Ion Saliu]

The other side to that story is that my forum was hit by the rogue admin/install folder exploit but no damage was done as my admincp was protected behind an IP based .htaccess file.

I was also hit by the Psychosama hack in September 2013. No damage was to my forum probably due to a .htaccess file. I was able to discover the skumbullows (who registered as Administrator more than 10 times). I deleted the scum and I banned the IP. It was the famous:

User: Th3H4ck
Email: [email protected]
User Title: Administrator

On the other hand, an IP based .htaccess file works only with static IPs. I don’t have one. Still, creating .htaccess files as per my previous post (via webhost AdminCP) does prevent most attacks. Or, at least, the forum attacks do not do serious damage.

How curious, the rest of my website (where my forum is hosted) has been virtually attack-free… or no real consequences noticed!

[donald1234]

On the other hand, an IP based .htaccess file works only with static IPs. I don’t have one.

I also have a dynamic IP on my broadband and to get round this problem I hired a low ram vps from lowendbox for the princly sum of $18/year and I use it as a vps proxy using the VPS's fixed IP address. This has the added advantage of providing a buffer between your computer and the internet giving you some protection against viruses and the like.