ISPconfig 3 - Password protect control panel as an extra layer of security

[orasis]

Originally Posted by till

ISPConfig uses already a good protection which includes also a brute force attack protection and blocking for the ispconfig login. So if you use the same username and password for the htaccess protection then you use for the ispconfig login you removed the brute force attack prevention of ispconfig.

I use different passwords on each, what caused me to do this were 3 things. It started from the phpmyadmin being exposed and I wanted to protect that first (now locked every user out of it ). 2 is, that the actual server admin login area is exposed, it is a common area for users and admins and I consider this a little ..(!) (or I am completely paranoid), maybe the server admin should use a secret address, and 3, the fact that I cannot change the default "admin" username (which is the default and known already to possible attacks) or create/delete server admins, maybe in order to change their default ID. I can create clients but not admins, is that right ?

Originally Posted by till

The symlink is a alternative approach to access ispconfig trough the default vhost of the server. Removing the symlink was only relevant for you as you added a additional password protection into the ispconfig vhost and the password protection could have been bypassed when the symlink is there. Removing the symlink is not required for any default install, it was just required for your setup.

Thanks for this explanation, I currently don't know "when" or from "where" the symlink could be used to access the control panel and bypass the authentication I added. Some info on this would be greatly appreciated.

[till]

the fact that I cannot change the default "admin" username (which is the default and known already to possible attacks) or create/delete server admins, maybe in order to change their default ID.

Of course you can change the default server admin name and you can add additional admin users as well in ispconfig. See System > CP user.

I can create clients but not admins, is that right ?

Thats wrong.

Thanks for this explanation, I currently don't know "when" or from "where" the symlink could be used to access the control panel and bypass the authentication I added. Some info on this would be greatly appreciated.

I mentioned that above but will explain it a bit more in detail: the symlink can be used to access ispconfig trough the default vhost. The default vhost is named default and it can be found in thefolder where all vhost files are. The default vhost is used when you access the server by IP address and no website is defined for that IP yet.

[orasis]

Originally Posted by till

The default vhost is used when you access the server by IP address and no website is defined for that IP yet.

This means that the address https://192.168.0.100:8080/ would not ask for password if I hadn't removed the symlink ?

You indeed are right about creating more admins I missed this I am sorry for myself... Does another admin need to be demoted first and then deleted ? cause logging in with a new admin account I created, still cannot see the delete icon next to the other admin.

great support by the way.

[till]

This means that the address https://192.168.0.100:8080/ would not ask for password if I hadn't removed the symlink ?

No. All request on port 8080 ask for apassword with and without symlink. The symlink is for the additional access with /ispconfig on the IP address. This is required in some setups where routers use port 8080 for their own webbased access.

You indeed are right about creating more admins I missed this I am sorry for myself... Does another admin need to be demoted first and then deleted ? cause logging in with a new admin account I created, still cannot see the delete icon next to the other admin.

Dont delete the default admin, just change its username.

[orasis]

Originally Posted by till

The symlink is for the additional access with /ispconfig on the IP address.

Trying:
http://192.168.0.100/ispconfig
or
https://192.168.0.100:8080/ispconfig
shows the default apache Not Found page.
But trying:
https://192.168.0.100/ispconfig (without :8080) brings up a site, in particular the last one I created on server and the site says Page Not found
Last question! ---> in case I want to recreate the symlink, what is the command please ? (thanks)

Originally Posted by till

Dont delete the default admin, just change its username.

Right! I am very happy ! after all my friend !

[till]

Last question! ---> in case I want to recreate the symlink, what is the command please ? (thanks)

ln -s /usr/local/ispconfig/interface/web /var/www/ispconfig

[orasis]

thanks till for everything
and keep it up !