Admin Tools

#30953 Whitelist Admin IP

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by [email protected] on Monday, 18 February 2019 00:52 CST

Sunday, 17 February 2019 20:49 CST

[email protected]

Is there a way to stop Admin IP addresses from being blacklisted??

So often we get clients locked out because they can't remember their passwords, then we have to delete them from the blacklist.

If we add a Whitelist, then all the Dynamic IP's can't get access.

What we need, is a Whitelist that prevents a Blacklisting, then they can try 10 different passwords, while hackers get locked out after 5.

Monday, 18 February 2019 00:31 CST

nicholas

You can't have this kind of blacklist because the criterion for the blacklist (am I an administrator) is post-fact to the attack you're trying to protect from.

The easy thing you can reasonably do is disable the "Treat failed login as a security exception" in Configure WAF and force all your users to use Two Step Verification or Two Factor Authentication.

If your clients have dynamic DNS (e.g. through DynDNS) you can whitelist them using the at-notation explained in the documentation. That is to say, if your client has the dynamic DNS myip.example.com add @myip.example.com to the administrator whitelist. Admin Tools will resolve the dynamic myip.example.com domain to an IP address and allow access to the site from that IP.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Monday, 18 February 2019 00:52 CST

[email protected]

OK, I understand, though I don't see why the logic couldn't work along these lines:

IF IP Address in Whitelist THEN Allow <= 50 attempts
ELSE Allow <= 5 attempts

But happy for you to close the ticket and maybe look at this in the next release.

Thanks

Support