Is it possible to make Drupal more secure by making LOGIN page private? I would like to make /user/login page private with Basic Auth so an user and password are needed before I get in that page.

Or is there another ways to make the login more safe? Goal is to prevent hackers to get in. Also if there's some module that helps on this it would be nice.


From your question

Is there another ways to make the login more safe?

Yes,try one of the following modules

Login Security

Login Security module improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site.

Secure Login

Secure Login module enables the user login and other forms to be submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in clear text. Secure Login module locks down not just the user/login page but also any page containing the user login block (or other forms that you configure to be secured).

| improve this answer | |

You could also:

  • Define https protocol for the login page (and the backend) on the Vhost directives. see https://www.drupal.org/https-information. But secure login or password policy module seems great because they also take care of the cookie protection.
  • Increase the passwords complexity (lenght, signs, etc). The module Password policy could interest you.
  • Setup fail2ban and create a jail for Drupal to ban recurrent attacker (see Vincent article for example)
| improve this answer | |

You may set up a Basic Auth on the /user/ URL.

See this question: https://serverfault.com/questions/532039/apache-basic-auth-for-a-particular-url

A proposed solution modified for this particular situation:

#set an environtment variable "auth" if the request starts with "/user"
SetEnvIf Request_URI ^/user auth=1

AuthName "Please login to access"
AuthType Basic
AuthUserFile "/path/to/my/.htpasswd"

# First, allow everybody
Order Allow,Deny
Satisfy any
Allow from all
Require valid-user
# Then, deny only if required
Deny from env=auth
| improve this answer | |
  • Hey, when I add that to .htaccess it displays it to all of the pages somehow, what to do? – John Dolby Mar 31 '15 at 16:12
  • Also where to store .htpasswd that its safe directory? – John Dolby Mar 31 '15 at 16:12
  • In all pages or just in all /user/* pages? Safe directory for .htpasswd depends on your system, it should be usualy outside your Drupal root directoy. For example in /etc/apache (if you have root privileges). Also you can name the file as you want. – sanzante Mar 31 '15 at 16:47
  • In all pages. I cant find the /apache folder either I know theres the certain directory that the htpasswd goes. – John Dolby Apr 4 '15 at 20:07
  • Tunic, I've get it to work, but which is the right place to put .htpasswd file if I cant fine /apache folder? I dont have rights to it anyway. – John Dolby Apr 9 '15 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.