1

Is it possible to make Drupal more secure by making LOGIN page private? I would like to make /user/login page private with Basic Auth so an user and password are needed before I get in that page.

Or is there another ways to make the login more safe? Goal is to prevent hackers to get in. Also if there's some module that helps on this it would be nice.

4 Answers 4

2

From your question

Is there another ways to make the login more safe?

Yes,try one of the following modules

Login Security

Login Security module improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site.

Secure Login

Secure Login module enables the user login and other forms to be submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in clear text. Secure Login module locks down not just the user/login page but also any page containing the user login block (or other forms that you configure to be secured).

1

You could also:

  • Define https protocol for the login page (and the backend) on the Vhost directives. see https://www.drupal.org/https-information. But secure login or password policy module seems great because they also take care of the cookie protection.
  • Increase the passwords complexity (lenght, signs, etc). The module Password policy could interest you.
  • Setup fail2ban and create a jail for Drupal to ban recurrent attacker (see Vincent article for example)
0

You may set up a Basic Auth on the /user/ URL.

See this question: https://serverfault.com/questions/532039/apache-basic-auth-for-a-particular-url

A proposed solution modified for this particular situation:

#set an environtment variable "auth" if the request starts with "/user"
SetEnvIf Request_URI ^/user auth=1

AuthName "Please login to access"
AuthType Basic
AuthUserFile "/path/to/my/.htpasswd"

# First, allow everybody
Order Allow,Deny
Satisfy any
Allow from all
Require valid-user
# Then, deny only if required
Deny from env=auth
7
  • Hey, when I add that to .htaccess it displays it to all of the pages somehow, what to do?
    – John Dolby
    Mar 31, 2015 at 16:12
  • Also where to store .htpasswd that its safe directory?
    – John Dolby
    Mar 31, 2015 at 16:12
  • In all pages or just in all /user/* pages? Safe directory for .htpasswd depends on your system, it should be usualy outside your Drupal root directoy. For example in /etc/apache (if you have root privileges). Also you can name the file as you want.
    – sanzante
    Mar 31, 2015 at 16:47
  • In all pages. I cant find the /apache folder either I know theres the certain directory that the htpasswd goes.
    – John Dolby
    Apr 4, 2015 at 20:07
  • Tunic, I've get it to work, but which is the right place to put .htpasswd file if I cant fine /apache folder? I dont have rights to it anyway.
    – John Dolby
    Apr 9, 2015 at 20:07
0

In Drupal 8 and 9, you can prevent anonymous access to the /user/login page using the Disable Login module. The module will require users to use an additional querystring and secret value for the querystring to access /user/login.

Admin user can set both the name of the QueryString and the value which will allow access to the login page.

For eg:

http://example.com/user/login

will give access denied.

http://example.com/user/login?key=secret

will allow the user to access the login page if key and secret are the name and value configured in the module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.