SECURITY --> URL rewriting
Posted: Sat Jan 30, 2010 12:48 pm
I reviewed the server logs yesterday and was shocked to find that the admin log in URL was taking a hammering. Whilst I am happy to put all my faith in one basket with your guys on the security of the login system, I would however like to take advantage of the Apache rewrite engine and curb this activity.
My knowledge of URL Rewriting is basically this... Crash course! Here is the beginnings, can someone help me put this right as its not working, I get server redirecting to an invalid address error. SO I change it slightly and by swapping out the $1 for %1 and still get the same error, when I use admin.domainname.com/cms/admin I get dumped at admin.domainname.com/cms/
What I would like to do is add a layer that pushes these login attempts to the site root /cms/ where the CMS is installed. The prefix in this instance is admin but it could be any. The idea being that this will allow someone to use cheeseontoast.mydomain.com/cms/admin and administer the site while all attempts on the admin URL for this site would dump the hack attempt in to the site root making it impossible to brute force their way in to the server.
This is something I have never used before as server management is not something I have had to consider until now. So anyone got any ideas on how I can fix this without having to hard code the domain name so that others viewing this can implement the same "front door policy" to add an additional layer of security to what I am sure is a robust login in system but for one weakness, the end user password!
I have already masked the editor name and I do use an alternate "Editor" name for the login, I assume that the hammering is assuming that the "norm" Editor username is being used...
So, please, what am I doing wrong, how can I tell if URL rewriting is actually working properly? It is installed on the server as .htaccess is used on some folders to protect them which is done via the adminCP of the host which does that job, they do not provide any other .htaccess tools or information. What I have hacked together is what I understand from having my head wrecked on the http'd apache site which TBH is a nightmare to get any coherent information from, its like they expect you to have prior knowledge!
Anyone got any ideas?
My knowledge of URL Rewriting is basically this... Crash course! Here is the beginnings, can someone help me put this right as its not working, I get server redirecting to an invalid address error. SO I change it slightly and by swapping out the $1 for %1 and still get the same error, when I use admin.domainname.com/cms/admin I get dumped at admin.domainname.com/cms/
What I would like to do is add a layer that pushes these login attempts to the site root /cms/ where the CMS is installed. The prefix in this instance is admin but it could be any. The idea being that this will allow someone to use cheeseontoast.mydomain.com/cms/admin and administer the site while all attempts on the admin URL for this site would dump the hack attempt in to the site root making it impossible to brute force their way in to the server.
Code: Select all
Options +FollowSymLinks
Options -Indexes
RewriteEngine On
# We need to test the URL to see if the request is for the admin URL
# 1. if the URL has /cms/admin/ in the REQUEST_URI and
# 2. if the DOMAIN has admin. as the subdomain, we issue the admin pages
RewriteCond %{REQUEST_URI} ^/cms/admin/$ [NC]
RewriteCond %{HTTP_HOST} ^admin\.(.*)/$ [NC]
RewriteRule .* http://$1/cms/admin/ [L]
# We need to test the URL to see if the request is for the admin URL witout the prefix
# 1. if the URL has /cms/admin/ in the REQUEST_URI and
# 2. if the DOMAIN has not got admin. as the subdomain, we issue the site root pages
RewriteCond %{REQUEST_URI} ^/cms/admin/$ [NC]
RewriteCond %{HTTP_HOST} !^admin\.(.*)/$ [NC]
RewriteRule .* http://$1/cms/ [L]
# if we get here, its likely nothing matched, so do nothing to the URL
RewriteRule .* - [L]I have already masked the editor name and I do use an alternate "Editor" name for the login, I assume that the hammering is assuming that the "norm" Editor username is being used...
So, please, what am I doing wrong, how can I tell if URL rewriting is actually working properly? It is installed on the server as .htaccess is used on some folders to protect them which is done via the adminCP of the host which does that job, they do not provide any other .htaccess tools or information. What I have hacked together is what I understand from having my head wrecked on the http'd apache site which TBH is a nightmare to get any coherent information from, its like they expect you to have prior knowledge!
Anyone got any ideas?
