Case #5083 - Notify admins upon detection of admin directory configuration issue

[dimitrifrom31]

Why disabling access to amdin area? Why not just adding a big red message on top of admin area saying "possible admin folder conflict detected - click to ignore"

[brian!]

Hi Duran, while your suggestion is a good one I think it is kind of a fatal issue. especially since there seems there wont be a fix.

the next passage is from the current changelog, seems like this is done on purpose

I think it's safe to assume that it was done on purpose - just not thought through or tested enough before release... not the first time that's occurred and I doubt it will be the last.

[SeanP]

If you change your admin directory to something nobody knows, what is the point in having the "fake" admin login? Change the admin directory to something obscure and hard to guess, and your admin area will be "hidden". To me the fake admin stuff is just a way to taunt potential hackers, and not really a true security tool. If they are worth their salt, by any means, they will be able to tell it is fake in a matter of seconds.

[merlinpa1969]

You are correct, it is a taunt, and honestly a way to track who where from how often and you get to have some fun as well with a BIG nasty gram,

If you change your admin directory to something nobody knows, what is the point in having the "fake" admin login? Change the admin directory to something obscure and hard to guess, and your admin area will be "hidden". To me the fake admin stuff is just a way to taunt potential hackers, and not really a true security tool. If they are worth their salt, by any means, they will be able to tell it is fake in a matter of seconds.

[dimitrifrom31]

If you change your admin directory to something nobody knows, what is the point in having the "fake" admin login? Change the admin directory to something obscure and hard to guess, and your admin area will be "hidden". To me the fake admin stuff is just a way to taunt potential hackers, and not really a true security tool. If they are worth their salt, by any means, they will be able to tell it is fake in a matter of seconds.

 

Perma ban the IP's logged by the fake admin.

[durangod]

storm troop their basement living and blowtorch their computers as they have to watch lmao. Then instead of their head on the fencepost we weld their hardrive to the fencepost out front of their home with a sign that reads "hacker lives here"

Edited September 20, 2014 by durangod

[SeanP]

Perma ban the IP's logged by the fake admin.

 

Do you do this automatically? If not, can't you just check your web server logs to see which IPs attempted access to /admin? You wouldn't need the actual fake admin pages in place for that. I would think this could be done via a daily cron job.

[merlinpa1969]

Its actually much easier to track from the fake admin interface, you can also track failed login attempts, I personally get an email with all the information ( browser, country IP what they typed in for username and password etc )

[SeanP]

Its actually much easier to track from the fake admin interface, you can also track failed login attempts, I personally get an email with all the information ( browser, country IP what they typed in for username and password etc )

 

I see... I guess you can capture more granular information, from the hack attempt, with the fake admin.

[isixhosting]

I upgraded rather quickly after the 5.3.10 release was made.

 

I use $customadminpath to set a custom path for my admin directory. I have done this for years.

 

I renamed the admin directory in the patch to my custom directory name. Now, when I try to view my admin site I am getting a message stating I am trying to access the admin area via a directory that is different from the one configured. But there's the rub, I'm not trying to access it via a directory different than the configured directory. I am trying to access it via the configured directory. The default 'admin' directory doesn't exist on my server, only my custom one.

 

Please help.

 

Thanks,

Joe

 

- - - Updated - - -

 

Okay, I managed to get in to the login page by setting the $customadminpath to a full relative path. My WHMCS is setup in a sub-directory so my path is /clients/mycustomadmindir. Never needed the /clients/ part before upgrading to 5.3.10.

 

Not entirely out of the woods yet because now I get "Language Folder Not Found" after logging in. I guess the full relative path doesn't work throughout WHMCS, just for the check to see if I'm using the right directory or not before allowing me to login. I'm glad this isn't supposed to be a stable release or anything.

 

Absolutely agreed - after replacing the init.php for the one of the version 5.3.9 we do get a stupid error in the support are, like we got it before the update to 5.3.10

 

 

- - - Updated - - -

 

someone else find a fix rather than the old init.php file, seems like the issue related to the folder path, check:

 

http://forum.whmcs.com/showthread.php?93362-5-3-10-and-customadminpath

 

The link/therad doesn't work anymore - WHY???

[Infopro]

Multiple threads have been merged into this one.

[isixhosting]

Multiple threads have been merged into this one.

 

Ok, and can you answer my issue with the "Fatal error: Call to undefined function releaseSession() in..." after we replaced the ini.php with the one of 5.3.9?

 

Thanks

[Infopro]

Please feel free to open a ticket to WHMCS Technical Support.

 

There is a thread located here as well that may be of some use:

http://forums.whmcs.com/showthread.php?87567-Admin-Folder-has-Duplicated-Itself

[DJFireCFH]

5.3.11 still has the same problem... have replaced the init.php file from 5.3.9 (again).. so they havent fixed it as of yet. maybe soon.

[WHMCS John]

Hi,

As my colleague Nate stated at this thread, there are currently no plans to introduce an option to switch the admin directory conflict check off.

[merlinpa1969]

Hi John, a little explanation as to why would be nice, Some of us use the /Admin directory to help catch ( Insert your Explitave here ) that try to hack Whmcs accounts,