I have a (Drupal 7) site which uses LDAP to authenticate logins according to an Active Directory groups only.

In the Apache config file, the URLs '/user' and '/admin' are both blocked externally. This has been tested and they can't be accessed, neither can '/user/register'.

I have found that some randomly-generated-looking username/email address combinations have appeared on the site. They're created in a blocked state due to the new accounts setting of requiring Administrator approval for a new account. All of their 'last accessed' fields are 'never'.

My question is how the accounts could have been created from an external connection without accessing the URL '/user/register', or any of the other blocked URLs?

  • Are you able to post the apache directives that are blocking the url's externally? – Scott Joudry Mar 24 '14 at 16:01
  • I can: # URL Access control to site access <Location ~ "/(user|admin)"> Order Deny,Allow Deny from all Allow from xxx.xxx.xxx.xxx </Location> xxx.xxx.xxx.xxx is an internal ip address – Chor Hatara Hud'u Keturi Mar 24 '14 at 16:06
  • Do you have any URL aliases of /user/register? – Scott Joudry Mar 24 '14 at 16:11
  • No. The only aliases are for articles. – Chor Hatara Hud'u Keturi Mar 24 '14 at 16:14
  • Maybe you have a module like Commerce which creates users automatically? I suggest looking in watchdog for entries for the time period right before the users.created. Also, grep your codebase for user_save. – greggles Apr 1 '14 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.