Search…

X3 Photo Gallery Support Forums

Search…

Security4 posts

Post Reply
 
Daystate
Topic Author
Posts: 7
Joined: 15 Jun 2018, 12:46

Security

18 Jun 2018, 09:04

Hi folks, I am new here. I have just deployed my own gallery.
Is there a way to enable some sort of filter within X3 script restricting where the admin connects to the configuration panel from?
Top
 
User avatar
mjau-mjau
X3 Wizard
Posts: 13997
Joined: 30 Sep 2006, 03:37

Re: Security

19 Jun 2018, 03:27

Do you mean restrict access to X3 control panel by IP address? Yes it is possible, and there is already an example included in the file /panel/disabled.htaccess. Please see this post for instructions:
viewtopic.php?p=37897#p37897

Another tip would be to rename your /panel/ directory to a name only you know, for example /daystate33panel/. After all, if nobody knows the name of the folder, nobody will be able to access it. This is in fact highly effective security through obscurity. Read more tips in my response here:
viewtopic.php?p=42936#p42816
Top
 
Daystate
Topic Author
Posts: 7
Joined: 15 Jun 2018, 12:46

Re: Security

19 Jun 2018, 05:54

Thank you mjau-mjau. I will definitely make a use of both links to improve security. 
How can I restrict access to X3 control panel to IPs from one country as I do not have static IP but can happily limit access to one country only.
Top
 
User avatar
mjau-mjau
X3 Wizard
Posts: 13997
Joined: 30 Sep 2006, 03:37

Re: Security

20 Jun 2018, 05:56

Daystate wrote:How can I restrict access to X3 control panel to IPs from one country as I do not have static IP but can happily limit access to one country only.
There is no simple recipe to allow IPs from ONE country, as one country (depending on what country) can have thousands of IP ranges. For example Germany:
https://lite.ip2location.com/germany-ip-address-ranges

Normally, you can set the allowed RANGE to the IP range of your internet provider. Or if you have MULTIPLE internet providers (for example mobile internet, office, home etc), you could set a couple of IP ranges from your internet service providers. For me, I have used something like this earlier (example):
Code 
# ADMIN PROTECT, IP only
RewriteCond %{REQUEST_URI} ^(.*)panel
RewriteCond %{REMOTE_ADDR} !^217\.237\.156\.[0-9]+
RewriteCond %{REMOTE_ADDR} !^2\.20\.248\.[0-9]+
RewriteRule .* - [F,NS]
In the above example, I am allowing access from only IP ranges 217.237.156.XXX and 2.20.248.XXX. Normally, your ISP will keep you on a single IP range like that, so it will suffice to allow login only from your IP range.

If you used a service like Cloudflare, you could utilize the "CF-Country-Code" header that they forward for each request.
Top
Post Reply