Restricting the administration #

This page is for system administrators at a host and for support staff who set up a customer's site. The administration is where content is published, roles are granted and settings are changed; the sign-in (/user/login, /admin/user/login) is the most attacked address of any site (Security hardening). The reference is 13.5 The administration siteaccess.

Contents #

1. What is there by default
2. Its own host name
3. Network restrictions
4. A browser check in front
5. Least privilege
6. Configuration from version control
7. The setup wizard stays closed
8. Checklist

What is there by default #

• The administration is a siteaccess of its own (usually admin). The installer writes [SiteAccessSettings] RequireUserLogin=true into its site.ini.append.php, so every page asks for a sign-in.
• Access to each function is decided by roles and policies (setup/*, content/*, audit/* ...).
• The sign-in costs the same for an unknown login as for a wrong password, so it does not reveal which accounts exist.
• The audit's alert rules brute_force (20 failures from one network in 5 minutes) and brute_force_user (10 for one account in 15 minutes) report attacks (Audit trail).

Its own host name #

Give the administration a host name of its own, for example admin.example.com, matched by [SiteAccessSettings] HostMatchType, rather than a path below the public site. It can then be restricted as a unit: its own virtual host, its own certificate, its own firewall rule. For hosts this also makes support simpler: the customer's editors know one address, and the public site's cache and CDN never see administration traffic.

Network restrictions #

From the strongest to the simplest, per web server:

<Location />
    Require ip 203.0.113.0/24 2001:db8::/48
</Location>

Behind a proxy, the address Exponential sees is the proxy's unless TrustedProxies[] is set; a restriction in the proxy itself avoids that question (TLS and HTTPS).

A browser check in front #

request-shield's Exponential examples put a browser check before the sign-in form and the administration, scan every parameter for attacks, and can limit the administration to a network (EXP-ADMIN-NET). The administration's background requests (the Admin 4 mega menu) get a machine-readable answer instead of a check page. Choose the main rules file by layout: exponential-admin-uri.rules for /admin on the same host, exponential-admin-host.rules for an administration host of its own. See request-shield and request rules.

Least privilege #

Give editors the roles they need, not Administrator. Policies that matter for security (13.5):

One personal account per person, and admin retired as a sign-in (Account hygiene). The host's own support staff should have personal accounts too, created and removed with their employment, never a shared "support" login.

Configuration from version control #

With [ConfigurationSettings] ManagedByDeployment=enabled on a production administration siteaccess, the administration cannot run the setup wizard, edit settings or templates, activate extensions or install packages (Configuration managed by the deployment). Use it where settings and templates come from Git: a stolen administrator session can then no longer change code or configuration.

The setup wizard stays closed #

On an installed site, setup/init only shows "This site is already installed" and writes nothing. Keep:

# settings/override/site.ini.append.php
[SiteAccessSettings]
CheckValidity=false

[SetupSettings]
AllowWizardOnInstalledSite=disabled

While CheckValidity is true (the shipped default before an installation), every request is sent to the setup wizard. Never set it back on a live site; the setup wizard on shared hosting page covers the provisioning side.

Checklist #

• To do: The administration on its own host name.
• To do: Restricted by network, VPN, basic authentication or the shield's browser check.
• To do: No shared logins; personal accounts for editors and for the host's support staff; admin retired.
• To do: Roles reviewed: setup/setup, audit/*, mailpreferences/export only where needed.
• To do: Two-step sign-in required for administrators (Two-step sign-in).
• To do: ManagedByDeployment=enabled where configuration comes from version control.
• To do: CheckValidity=false, AllowWizardOnInstalledSite=disabled.

Related pages #

• Security for hosts: overview
• Chapter 13: The administration siteaccess
• Change the administrator password
• Request rules
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.