0

Hello fellow Drupalers,

I've been given the task of securing our admin account, on our websites (drupal 7) from outsiders.

My first thought was 2FA and I looked at some of the modules (tfa, google auth, etc) and they seem to be doing the job okay.

But as I was fiddling around I accidentally deleted the admin password.

Now I cannot login through the website with the admin account, but I can via drush uli.

Do you guys consider this to be an okay solution for securing the admin account? I personally have my doubts about it, because it seems so simple...

Improve this question
5
  • How exactly did you delete the password?
    – No Sssweat
    Jul 7, 2021 at 9:54
  • Via the database, just fiddling around.
    – Lars Hansen
    Jul 7, 2021 at 9:58
  • It was on my local dev version...
    – Lars Hansen
    Jul 7, 2021 at 10:06
  • Curious, if you inspect element on password field and remove the required="required" and leave password empty does it log you in?
    – No Sssweat
    Jul 7, 2021 at 10:13
  • That was a good question. I've tested it, and I still cannot login even though the required has been removed.
    – Lars Hansen
    Jul 7, 2021 at 10:24

1 Answer 1

Reset to default
0

Definitely not a solution I would rely on. "Securing admin account" is a wide topic that needs to be handled carefully, but answering specifically to your question, if what you want is to "protect" the password, you can run a cronjob that changes the password string to a random, SHA value, every X time. I've seen that in some clients.

Talking about MFA (2FA), yes, this adds a pretty solid and common layer of security. Also implemented it for some clients.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.