4

I want to restrict the http://www.mysite.com/admin login page to a particular IP only. Do you have any suggestion?

6
  • Would this question be of any help to you? drupal.stackexchange.com/questions/58898/…
    – frazras
    Commented Jul 28, 2013 at 6:56
  • im not sure, check the login security module
    – Bala
    Commented Jul 28, 2013 at 12:18
  • 1
    There isn't a login form at /admin; you'd get a 403 unless there's a module interfering (maybe r4032login or similar). So you'll need to alter the output of whatever that module is to get the effect you're looking for. Could you update the question with that information?
    – Clive
    Commented Jul 28, 2013 at 15:37
  • The login page is at /user/login (Though /user display this page if you are not logged in). Have you tried blocking that path as well? Commented Jul 24, 2017 at 14:41
  • 1
    "I tried using the Restrict IP module to block the /user and ?q=user routes but this did not work." - did you try debugging why? Is the site behind a load-balancer? Are you forwarding IPs to Drupal correctly?
    – Joseph
    Commented Jul 24, 2017 at 14:53

5 Answers 5

7

I think I would go for doing this at the Apache level before hitting Drupal.

Have a look at the Apache manual for doing this but you are looking at something like this:

# Only allow request for admin only from localhost.
<Location /admin>
  Deny from all
  Allow from 127.0.0.1
</Location>

So admin will be denied for all but allowed from 127.0.0.1 for example. Also take in to account cleanurls. You will need to deny access to ?q=admin aswell.

6

There are a lot of IP modules out there that block access to the website by IP, but these are black/whitelists for the whole website.

There is a module called Restrict IP which only allows whitelisted IPs to log in.

In general, this module provides features that allow an IP address (or range of IP addresses) to be whitelisted which restrict the functionality of users. Currently there are two features implemented:

Restrict login by IP

When a user is restricted, that user will not be able to log in outside the defined IP address ranges. It is also possible to specify global IP address ranges, which apply to ALL users, including user1. Following a denied log-in attempt, a user is redirected to an error page as specified by the site administrator.

Restrict role by IP

When a role is restricted, that role will not be available to users outside the defined IP address ranges. Role restriction does not affect users' ability to log in, only the availability of the restricted role to users. Role restrictions are available for all roles, except "anonymous user" and "authenticated user".

1
  • "Restrict role by IP" modules seems not to work anymore!
    – Tapash
    Commented Jul 30, 2019 at 18:33
3

This code may help you. (Replace mymodule with machine name of the module containing this code.)

function mymodule_menu_alter($items) {
  $items['admin']['access callback'] = 'mymodule_check_by_ip';
}

function mymodule_check_by_ip() {
  if (in_array($_SERVER['REMOTE_ADDR'], ['PARTICULAR_IP_ADDRESS', 'ANOTHER_PARTICULAR_IP_ADDRESS'])) {
    return FALSE;
  }

  return TRUE;
}
0
1

This can be done by configuring .htaccess to raise the [F] flag (returns a 403 Forbidden status code to the client) for certain URLs when %{REMOTE_ADDR} doesn't match a given IP.

To be placed after RewriteEngine on:

RewriteCond %{REMOTE_ADDR} !^100\.22\.44\.[8-9]$
RewriteRule ^/user - [F]
RewriteRule ^/USER - [F]
0

There is a module available for D7 to provide page level access for IPs

Restrict Page IP

Provides administrator to restrict/allow access to pages based on user IPs.

Features

  • IPs can be an individual IP or range of Ips.
  • Page url can have wild cards like 'blog/*'
  • Restricted user IPs will be denied showing custom error message (can be modified on module's configuration page)

Note : User 1 has been skipped from these restrictions.

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.