[BlueOnyx:05460] Re: Dealing with /admin URL 'hijacking

[Abdul Rashid Abdullah]

What's the CMS?


On 9/25/10 7:01 AM, "Jeff Jones" <jeffrhysjones at mac.com> wrote:

> Yes - but alas - this *particular* CMS - it does not make it easy for you -
> you have to modify something like 20 files, it's a real pain. Changing the CMS
> is not an option either - we love it!
> 
> I have put in a number of requests to the developers - asking if there is an
> easier way, but nothing back yet.
> 
> So in my case, I like to take the path of least resistance - edit the BX
> config file!
> 
> Cheers,
> 
> Jeff
> 
> On 25 Sep 2010, at 14:47, Abdul Rashid Abdullah wrote:
> 
>> Stephanie hit the nose on the target.  I would prefer to modify the CMS
>> rather than BlueOnyx.  When you migrate to a new system, you will deal with
>> the issue all over again.  It is best to change it upfront.
>> 
>> PLUS I am not sure who said something about BlueOnyx security and they
>> deleted it for that reason but I would say that it is FAR better to rename
>> the admin of a CMS as there is by far a higher likelihood of an exploit on
>> the CMS than on BlueOnyx coming into play.  Zen Cart as an example EXPLICTLY
>> encourages all of the users to rename to something unique and specifically
>> warns you if I am remembering correctly if you don't do it.  It is one of
>> their counter measures for not getting hacked.
>> 
>> Regards,
>> 
>> Rashid
>> 
>> 
>> On 9/24/10 7:08 AM, "Stephanie Sullivan" <ses at aviaweb.com> wrote:
>> 
>>> Jeff,
>>> 
>>> I've yet to meet a decent CMS or shopping cart that does not allow (most
>>> even encourage) changing the default path to the admin section of the code.
>>> Usually there is some configuration file which carries the base path for the
>>> CMS so it can readily be something other than "/admin". I hope this applied
>>> to this hereto fore unnamed CMS.
>>> 
>>> Thanks,
>>> -Stephnaie
>>> 
>>> 
>>>> -----Original Message-----
>>>> From: blueonyx-bounces at blueonyx.it [mailto:blueonyx-
>>>> bounces at blueonyx.it] On Behalf Of Jeff Jones
>>>> Sent: Thursday, September 23, 2010 10:23 AM
>>>> To: BlueOnyx General Mailing List
>>>> Subject: [BlueOnyx:05453] Re: Dealing with /admin URL 'hijacking
>>>> 
>>>> Yes - I can get to the CMS using the absolute path - the only problem
>>>> is that with this particular CMS - it makes calls to /admin in the
>>>> GUI - and this then redirects back to the BX Admin!
>>>> 
>>>> So the silver bullet is to either remove or rename the admin
>>>> redirect..
>>>> 
>>>> Cheers,
>>>> 
>>>> Jeff
>>>> 
>>>> On 23 Sep 2010, at 15:12, Klein Joachim wrote:
>>>> 
>>>>> Am 23.09.2010 15:55, schrieb Chris Gebhardt - VIRTBIZ Internet:
>>>>>> Jeff Jones wrote:
>>>>>>> Hi guys,
>>>>>>> 
>>>>>>> We have a web CMS on a BX box that has a url /admin and
>>>> unfortunately it does not appear easy to change this admin URL much
>>>> to my disgust.
>>>>>>> 
>>>>>>> I think I have seen some posts around - but I am not sure if
>>>> anyone managed to find an easy way to change the BX /admin url to
>>>> something a little less easier to guess.
>>>>>> Something that you try in order to avoid tinkering would be to use
>>>> the
>>>>>> page name in the URL of the CMS admin, likely "index.php".  So
>>>> instead
>>>>>> of going to www.domain.tld/admin go to
>>>> www.domain.tld/admin/index.php
>>>>>> and I bet your CMS management page pops up.
>>>>>> 
>>>>> Hy Chris!
>>>>> 
>>>>> That´s right - but tell this the customer.
>>>>> I´m using also only the /admin-part and not the complete one.
>>>>> I had a customer who called me with exact this problem.
>>>>> 
>>>>> Customer: "I have installed a CMS on the webspace but my password
>>>>> wouldn´t accepted"
>>>>> Support worked a long time to find out that the user was trying to
>>>> login
>>>>> to the Blueonyx-Admin and
>>>>> not the CMS of the User.
>>>>> The Install wasn´t the problem because the directory was /install,
>>>> but
>>>>> then the Admin was /admin.
>>>>> And if you have some customer without too much technical knowhow
>>>> then
>>>>> you get silly.
>>>>> 
>>>>> That´s the reason why I have deleted all the /admin-Redirects.
>>>>> Joachim
>>>>> 
>>>>> _______________________________________________
>>>>> Blueonyx mailing list
>>>>> Blueonyx at blueonyx.it
>>>>> http://www.blueonyx.it/mailman/listinfo/blueonyx
>>>> 
>>>> 
>>>> _______________________________________________
>>>> Blueonyx mailing list
>>>> Blueonyx at blueonyx.it
>>>> http://www.blueonyx.it/mailman/listinfo/blueonyx
>>> 
>>> 
>>> _______________________________________________
>>> Blueonyx mailing list
>>> Blueonyx at blueonyx.it
>>> http://www.blueonyx.it/mailman/listinfo/blueonyx
>>> 
>>> 
>> 
>> 
>> 
>> _______________________________________________
>> Blueonyx mailing list
>> Blueonyx at blueonyx.it
>> http://www.blueonyx.it/mailman/listinfo/blueonyx
> 
> 
> _______________________________________________
> Blueonyx mailing list
> Blueonyx at blueonyx.it
> http://www.blueonyx.it/mailman/listinfo/blueonyx
> 
>