[BlueOnyx:05459] Re: Dealing with /admin URL 'hijacking

[Jeff Jones]

Yes - but alas - this *particular* CMS - it does not make it easy for you - you have to modify something like 20 files, it's a real pain. Changing the CMS is not an option either - we love it!

I have put in a number of requests to the developers - asking if there is an easier way, but nothing back yet.

So in my case, I like to take the path of least resistance - edit the BX config file!

Cheers,

Jeff

On 25 Sep 2010, at 14:47, Abdul Rashid Abdullah wrote:

> Stephanie hit the nose on the target.  I would prefer to modify the CMS
> rather than BlueOnyx.  When you migrate to a new system, you will deal with
> the issue all over again.  It is best to change it upfront.
> 
> PLUS I am not sure who said something about BlueOnyx security and they
> deleted it for that reason but I would say that it is FAR better to rename
> the admin of a CMS as there is by far a higher likelihood of an exploit on
> the CMS than on BlueOnyx coming into play.  Zen Cart as an example EXPLICTLY
> encourages all of the users to rename to something unique and specifically
> warns you if I am remembering correctly if you don't do it.  It is one of
> their counter measures for not getting hacked.
> 
> Regards,
> 
> Rashid
> 
> 
> On 9/24/10 7:08 AM, "Stephanie Sullivan" <ses at aviaweb.com> wrote:
> 
>> Jeff,
>> 
>> I've yet to meet a decent CMS or shopping cart that does not allow (most
>> even encourage) changing the default path to the admin section of the code.
>> Usually there is some configuration file which carries the base path for the
>> CMS so it can readily be something other than "/admin". I hope this applied
>> to this hereto fore unnamed CMS.
>> 
>> Thanks,
>> -Stephnaie
>> 
>> 
>>> -----Original Message-----
>>> From: blueonyx-bounces at blueonyx.it [mailto:blueonyx-
>>> bounces at blueonyx.it] On Behalf Of Jeff Jones
>>> Sent: Thursday, September 23, 2010 10:23 AM
>>> To: BlueOnyx General Mailing List
>>> Subject: [BlueOnyx:05453] Re: Dealing with /admin URL 'hijacking
>>> 
>>> Yes - I can get to the CMS using the absolute path - the only problem
>>> is that with this particular CMS - it makes calls to /admin in the
>>> GUI - and this then redirects back to the BX Admin!
>>> 
>>> So the silver bullet is to either remove or rename the admin
>>> redirect..
>>> 
>>> Cheers,
>>> 
>>> Jeff
>>> 
>>> On 23 Sep 2010, at 15:12, Klein Joachim wrote:
>>> 
>>>> Am 23.09.2010 15:55, schrieb Chris Gebhardt - VIRTBIZ Internet:
>>>>> Jeff Jones wrote:
>>>>>> Hi guys,
>>>>>> 
>>>>>> We have a web CMS on a BX box that has a url /admin and
>>> unfortunately it does not appear easy to change this admin URL much
>>> to my disgust.
>>>>>> 
>>>>>> I think I have seen some posts around - but I am not sure if
>>> anyone managed to find an easy way to change the BX /admin url to
>>> something a little less easier to guess.
>>>>> Something that you try in order to avoid tinkering would be to use
>>> the
>>>>> page name in the URL of the CMS admin, likely "index.php".  So
>>> instead
>>>>> of going to www.domain.tld/admin go to
>>> www.domain.tld/admin/index.php
>>>>> and I bet your CMS management page pops up.
>>>>> 
>>>> Hy Chris!
>>>> 
>>>> That´s right - but tell this the customer.
>>>> I´m using also only the /admin-part and not the complete one.
>>>> I had a customer who called me with exact this problem.
>>>> 
>>>> Customer: "I have installed a CMS on the webspace but my password
>>>> wouldn´t accepted"
>>>> Support worked a long time to find out that the user was trying to
>>> login
>>>> to the Blueonyx-Admin and
>>>> not the CMS of the User.
>>>> The Install wasn´t the problem because the directory was /install,
>>> but
>>>> then the Admin was /admin.
>>>> And if you have some customer without too much technical knowhow
>>> then
>>>> you get silly.
>>>> 
>>>> That´s the reason why I have deleted all the /admin-Redirects.
>>>> Joachim
>>>> 
>>>> _______________________________________________
>>>> Blueonyx mailing list
>>>> Blueonyx at blueonyx.it
>>>> http://www.blueonyx.it/mailman/listinfo/blueonyx
>>> 
>>> 
>>> _______________________________________________
>>> Blueonyx mailing list
>>> Blueonyx at blueonyx.it
>>> http://www.blueonyx.it/mailman/listinfo/blueonyx
>> 
>> 
>> _______________________________________________
>> Blueonyx mailing list
>> Blueonyx at blueonyx.it
>> http://www.blueonyx.it/mailman/listinfo/blueonyx
>> 
>> 
> 
> 
> 
> _______________________________________________
> Blueonyx mailing list
> Blueonyx at blueonyx.it
> http://www.blueonyx.it/mailman/listinfo/blueonyx