I would like to implement a private, intranet-like Drupal 8 based site that is accessible via the internet but that does not show up in search engine results.
I have already researched solutions and found some promising ones, which I could combine, perhaps along with my own bespoke custom module.
I'm asking on here for the following:
for an all-in-one solution to consider (though, once again I stress that I am very happy to work with combining existing partial solutions along with my bespoke custom code. Just don't want to "re-invent the wheel" by duplicating what's already out there)
for potential pitfalls of my ideas and potential solutions (if all-in-one not available)
To expand on the non-search results requirement:
this private intranet site is for colleagues only to log into once conveniently but so that it doesn't doesn't need to be found via search as they will know the direct URL web address. They will already have accounts setup on the site by an administrator, with login via http auth enabled for their role.
this private intranet site URL web address shares the same main domain as the public site, but with a subdomain, so I would want to avoid the private site "polluting" the SEO/search results of the public site
by avoiding web crawlers, as well as avoiding "polluting" the main public site's SEO, the private site will not be found and hidden away from those who might be curious/hackers. Perhaps not completely able to hide, but reduces the possibility.
My approach to the requirement is to:
- use basic http auth login - i.e. a pop-up login and then
- use the REMOTE_USER environment variable generated by the login to auto-login the user to the Drupal site to be able to access the admin pages. This is a key important requirement for me to save them having to login twice 1) to get past the http auth login and 2) to then login as a user to Drupal.
- I may restrict users who enter the site via this basic http auth way to a reduced admin role for security purposes
- I will probably consider an additional security such as 2FA (two-factor authentication), probably send an email with a code to the user's email account. SMS could also be considered but there would be a network charge for this (either for me as a cost to bear as the provider or in reverse for the user to bear, if that is at all possible). This does reduce the convenience of logging in a little as further work by the user is required, but perhaps less cumbersome from a UX perspective than having to remember 2 logins, firstly for http basic auth, and secondly for the Drupal login. Also, the email sent would contain a different code each time so no need for the user to remember it.
My research so far:
security of http basic auth: Is BASIC-Auth secure if done over HTTPS? - outcome: as I am using the brilliant free Let's Encrypt generated https cert, I have https and so the passing of the user and password via the pop-up form into the site should be secure, according to this question
additional security - 2 factor authentication. I am aware of the existence of the tfa module but haven't tried it out yet. At time of writing it's alpha for Drupal 8. At this time, a more suitable approach would be for me to write a custom module to send an email to the user's email address.
specific Drupal role for users logging into the site this way. This would be straightforward enough to do via custom module code, to check for the role in the user.
implementing the basic http-auth itself: this is simple enough to do via the web server vhost or .htaccess config (apache, nginx) but I am aware of some Drupal modules that also do this and therefore might offer convenient control rather than having to manage via logging in as root admin to server. Modules I am aware of are:
webserver_auth - close to what I want (I think it logs the user into Drupal via http auth) - there is a Drupal 8 dev version at time of writing
http_auth_ext - again close to what I want but seems abandoned, but worth studying for my own custom implementation
securesite - very close and perhaps better documented than the others
https://www.drupal.org/sandbox/dsnopek/2135005 sandbox project, worth studying
basic_auth - worth studying but perhaps not quite what I'm looking for, part of Drupal 8 core
http_auth - looks similar to basic_auth, wondering if it duplicates that or does something different. Does look like it provides basic http auth without the need for web server vhost configuration