Can be administrator directory effectively renamed (for example by simple change in Joomla! core code) for example to admTZ34? The main reason is to obfuscate standard pattern where www.example.com/administrator could be used to check presence of Joomla! installation (in older releases also Joomla! version etc.)
1
-
2Before Joomla SE was set up I asked this same question here on SO: stackoverflow.com/questions/15034980/…– tim.bakerMay 5, 2014 at 12:58
Add a comment
|
3 Answers
It's not really recommended or very simple to do. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of consequences.
That said if you want to prevent direct access try with one of this solutions:
A) Password protect /administrator with a .htaccess password protection.
This uses HTTP authentication to prevent anyone from getting to the admin directory.
http://httpd.apache.org/docs/current/programs/htpasswd.html
B) Require a keyword in the URL with an extension like:
- AdminExile
- JSecure
- KSecure
-
Admin tools is capable of doing both options for you.
With one of this extensions the admin url will be:
yoursite.com/administrator/?mySpecialPhrase
-
Quick question regarding your first point. Will protecting it using a .htaccess file prevent files being moved the necessary directories within the administrator folder upon installation of extensions?– LodderMay 4, 2014 at 23:59
-
3I don't believe so because .htpasswd will only check for http access. When copying files around via the installer I think all that happens at the server level so I don't think this will matter. That said, I have seen issues with things like javascript being stored in /administrator and being called via HTTP on the front end and asking users to login. So this isn't always a workable solution. May 5, 2014 at 0:07
-
@ChadWindnagle +1 from my side in your answer and your comments. Backend Protection through htaccess is a good solution but few extension fetch site's images and javascript from site's backend, In-that case htaccess restrict to access these images and javascripts. May 5, 2014 at 5:09
-
Continue @ChadWindnagle answer 3) Use two factor authentication extensions.joomla.org/extensions/access-a-security/… May 5, 2014 at 5:10
-
Nice suggestion on 2 factor. That said I think it's in Joomla 3.2+ so an extension shouldn't be necessary if running latest version of Joomla. May 5, 2014 at 14:10
You can't really change it as it would prevent extensions from installing properly. You can however use Admin Exile which allows you to add a value, key or both to the administrator URL. In addition to this, if the standard admin URL is typed it, it will redirect the user to a site of your choice.
http://extensions.joomla.org/extensions/access-a-security/site-security/login-protection/15711
Hope this helps
-
So if I understand, the main problem is plugins, right? Can it be said that Joomla! installation without extensions can withstand renaming of administrator directory relatively safely?– miroxlavMay 5, 2014 at 0:06
-
1Extensions in general, not just plugins. There are also other reasons why you should not change the name of the folder. One reason @Chad explains regarding JTables– LodderMay 5, 2014 at 0:07
-
In addition to that, the whole thought process of renaming /administrator/ in general as a practice is not a good one. It's not "real" security. The author of Akeeba backup and a Joomla security expert wrote about a similar type of move regarding configuration.php [dionysopoulos.me/keep-your-files-where-i-can-see-them/] I'd recommend reading that to understand why this type of change is frowned upon. May 5, 2014 at 0:11
If your only concern is bad-bots identifying your website as joomla website then you need to do a lot more to hide this truth.
A lot of technique exist to identify your website as joomla and its version. This .htaccess file helps in these attacks.
