0

In our environment, we make changes to a drupal site that are then replicated to an outside webserver. We do not want people to be able to log into the drupal site from the outside. I want to remove whatever file /user and /admin resolves to but I can't find any information on this. In wordpress, you delete the wp-admin folder. Is there anything like this with Drupal? Turning off the "Allow login" setting will not work for us.

Note- We cannot make any changes that are saved in the database. Changing Drupal settings will not work. There's got to be a login file on the server we can delete.

Improve this question
3
  • Take a look at this answer on Stackoverflow stackoverflow.com/questions/6352381/…
    – fullerja
    Jun 29, 2015 at 15:04
  • While this stackoverflow article can achieve what I am asking, it makes a change to the database. If I do this, is there also a way to delete the admin login functionality.
    – Parker
    Jun 29, 2015 at 15:17
  • I would suggest you to use this module to change the userlogin path and user admin path. you can configure as tough as you want and make it secure.
    – shrish
    Jun 29, 2015 at 15:30

5 Answers 5

Reset to default
1

Just have an htaccess entry that redirects /user and /admin to the front page.

Improve this answer
0

Well you could do a couple of things but you would need to have full access to the admin in the backend and I'm not really sure that if you are saying that the access in the backend is just changing the same database or the content is being pushed by a services type deploy module.

The first thing is hiding the login blocks, which you probably already have done this but here is a link: https://www.drupal.org/node/13777

Next, depending on your setup you will want to either forward the /user (or /user/login if you have user profiles that are on that path) to the home screen. That will make it impossible for a user to login. You could do this with an htaccess rule which is a little out of scope for Drupal Answers or do a redirect using either the redirect module or the rules module. Depending on your setup the rules could match the URL (say if the URL is admin.example.com for the admin install) and forward only the main site /user page to the home page so your users on the admin install can still access the site.

There are probably some more ways to do this, I will add more as I think of them.

Improve this answer
0

There's an alternative:

https://www.drupal.org/project/login_disable

This module requires a "secret" token to access the user login page:

Example: http://example.com/user/?hell0darling-XD

Improve this answer
0

you can remove the login functionality technically, but if you do it, then your administrator could never log onto the site.

you can remove the registration functionality, you simply need to browse to admin/user/settings (for Drupal 6) or admin/config/people/accounts (for Drupal 7) and select the the "Only site administrators can create new user accounts" option.

Reference

Improve this answer
0
0

The best way is not to fiddle with the core, or you may end up breaking your site (when applying updates, patches etc). Better way is to implement IP based login (with .htaccess) or use one of the available modules that restricts admin path to selected IP.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.