Restrict admin access to LAN

[snis]

If you want to restrict your Bubba admin interface (http://bubba/admin) to you local LAN and not having it enabled on the WAN for the rest of the world to see, this guide might be for you.

Using ssh, log on to Bubba (as your regular user). To become root Type:

Code: Select all

su -

And enter the password:

Code: Select all

excito

If you haven't changed the default, that is.

Edit your the admin part of the Apache config:

Code: Select all

nano /etc/apache2/conf.d/admin.conf

You will find the part <Directory /usr/share/web-admin/admin>, change it to:

Code: Select all

<Directory /usr/share/web-admin/admin >
        AllowOverride None
        Order Deny,Allow
        Deny from all
        Allow from 192.168.10.0/24
        DirectoryIndex index.php
        AddHandler php-cgi .php
        Action php-cgi /fcgi-bin/php.cgi virtual
</Directory>

Observe that the network 192.168.10.0/24 should match the network you have on your LAN. If you are unsure can find it under:

Code: Select all

http://bubba/admin/network/lan

For example: your IP address is: 192.168.0.10 and your netmask is 255.255.255.0, then the Allow from should be:

Code: Select all

Allow from 192.168.0.0/24

After you have edited the file, you have to reload Apache to reflect the changes. Type the following:

Code: Select all

/etc/init.d/apache2 reload

Done!
This change will likely be overwritten and changed back to the defaults if you upgrade your Bubba

If you have any better ways of doing this, please let me know..

[drdr6]

I tried this and after the change no users at all seem to be able to log in from outside

Pretty much the first thing that Forum won't this-forum-won't-allow://mydomain redirects (on its own to) is this-forum-won't-allow://mydomain/admin and then says "Forbidden"

[Ubi]

how strange that you found absolutely no help in the log files about this problem, even after extensively searching through them.

[Eek]

I have not tried it, but should it not be

Code: Select all

        Order Allow,Deny
        Allow from 192.168.10.0/24
        Deny from all