Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modify admin login path #727

Closed
oleteacher opened this issue Apr 24, 2024 · 3 comments
Closed

Modify admin login path #727

oleteacher opened this issue Apr 24, 2024 · 3 comments

Comments

@oleteacher
Copy link

Due to so many hits on the internet facing install of HTMLY admin login, the school IT department has shut off our installs of HTMLY.

I am told that if I cannot come up with a solution to change the path to login and admin, we will have to find another platform. This is of course not something any of us want, we love HTMLY :)

My question: how can I modify the /login and /admin paths? Need to be able to use random words in place of login / admin.

Looked at .htaccess and see no reference to login / admin.

Please give me some ideas so we can start using HTMLY again.

@danpros
Copy link
Owner

danpros commented Apr 24, 2024

Hello,

To modify the /login and /admin path, it needs quite a lot of changes.

htmly using bcrypt as the hash algo (default as of PHP 5.5.0). With good password, at least 8 char and contains upper, lower, number and symbols it need 286 years to crack it (info).

To prevent brute force, you can enable the Google reCaptcha (link).

Good luck! 😃

@oleteacher
Copy link
Author

Thank you for the input Dan.

The issue is not the security of the script. Issue is: one school campus that has 10+ teachers with internet facing blog to keep parents updated. This is just one campus. Multiply that by 20+ campuses. 200+ installs of HTMLY with all of them using admin/ and/or login/. The amount of rouge traffic is staggering, hits that just keep coming hour after hour 24/7.

The IT department will just not allow such.

Anyway, thank for reply.

@vdbhb59
Copy link
Contributor

vdbhb59 commented May 20, 2024

Thank you for the input Dan.

The issue is not the security of the script. Issue is: one school campus that has 10+ teachers with internet facing blog to keep parents updated. This is just one campus. Multiply that by 20+ campuses. 200+ installs of HTMLY with all of them using admin/ and/or login/. The amount of rouge traffic is staggering, hits that just keep coming hour after hour 24/7.

The IT department will just not allow such.

Anyway, thank for reply.

Teachers can keep logged in or use another IP for login and then switch to campus wifi. However, that is a temporary solution, up until your issue is resolved. Another way is to add each one as a user to one installation itself. Grant them admin rights and that should minimize hopefully.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants