Can attacker circumvent a htaccess 'deny from all' command - .htaccess

I applied an htaccess file to the /administrator directory of a joomla website that is supposed to whitelist only my local ip address and my public ip address .
However, it appears that a new user account was created within that joomla account a couple of months after I applied the white list.
Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from 77.##.##.###
Can someone offer a theory on how this is possible?

Users can be created via front-end, even if you don't have a registration link or form there. Registration might be accessed by going to: index.php?option=com_users&view=registration
You can disable this option in Joomla back-end. To do so go to: System -> Global Configuration -> Users Manager and turn Allow User Registration to NO.

Related

Active Directory Domain Controller setup using external TLD (Godaddy)?

I have been given a task to integrate Active Directory in order to authenticate users and manage group policies. My end-goal is to allow users to enroll their devices (Mac and PC) into Active Directory using their company email address (ie. bob#example.com).
Currently, our company uses Godaddy to manage our DNS for our TLD (example.com). I have used a subdomain to allow public access to our domain controller (dc.example.com - Windows Server 2019). Now, because I've made the Domain Controller a subdomain of example.com, when I create an AD user, I can only register them in the dc.example.com namespace. Rather, I want users to be able to login using the top-level domain example.com.
I have been reading up on domain naming best-practices and everything tells me to use a subdomain rather than duplicating the root domain name. I have actually done the latter... and it works. However, it creates conflicts when I am trying to register Mac computers to Active directory. I don't know why.
I dont want to move away from Godaddy since we have many records stored there, but there MUST be an easier way to do this?

Avoid Custom Domain Name Rewriting URL to Google Site

I have registered my domain name example: zoek.com in Google domains forwarding it to google sites sites.google.com/view/zoek/home.
Now, whenever users are visiting zoek.com, the URL in the browser is redirecting to sites.google.com/view/zoek/home. Instead, I want to retain on zoek.com
I added CNAME record as per instructions, still no luck
I don't have GSUITE. I want to do it without GSUITE. Is it possible?
IF I have to buy GSUITE then what's the cost of it yearly?
Thanks in Advance!

How to allow specific domain name to access my domain?

I have this in my .htaccess
<Limit GET POST>
Deny from all
Allow from xxx.x.xxx.x
Allow from xxx.xx.xxx.x
Allow from xxx.xx.xx.x
</limit>
So I am good with this setup now I am allowing certain ip to access my server but now I need add another but I cannot get their ip address so I need to allow via their url. How can I accomplish this case?
for example I want developer.paypal.com/(any) to allow to access the php scripts in my server
You can use:
Allow from bla.com
Assuming that bla.com is the domain name and that it is properly assigned to the IP that is making the requests to your site.
If the IP is not properly assigned to that domain name or is dynamic you can use a different approach such as user and password authentication, and others available.

block user accessing website

I want to block a specific user to access my website. I know it is not possible with Dynamic IP. Is there any other alternate to block the specific user to access website? I'm currently at APACHE LINUX based server.
The user manages web account at my website.
I'm managing a user account on PHP with $_SESSION variables. The user are authenticated using login and password just like any shopping cart website.
Unless the user has to log in, you have no way of knowing who is accessing your site if he's on a dynamic ip address. The only mechanism I can think of is to check any cookie that identifies the user that you've already placed on his system. This wouldn't of course stop them from accessing your site from a different machine.
Long story short - unless the user has to log in first of all, or you have some other means (cookie?) of identifying the user, then not that I know of.
can be achieved by .htaccess
to block a specific ip,
order allow,deny
deny from 127.0.0.1
allow from all
or use this to block a complete range of ip,
deny from 127.0.0

how to redirect any domain name to our web application

we have a saas web app, written in zend mvc (php) where users can enter their own domain name in their settings page.
When they enter e.g. www.customdomain.com we want this domain to redirect to our web application so we can serve up their own pages from our app.
We do the same already for subdomains by having a *.ourapp.com entry in our DNS configuration.
that works great for subdomains like customdomain.ourapp.com.
This doesn't seem to work for full domain names like www.customdomain.com.
What's the easiest way to have any domain address link to our application, so we can just read out the incoming domain name and act accordingly in our app?
For letting the DNS entry point at your servers:
Domain is already registered (and owned by the customer): Make him configure the CNAME entry to your server's IP. (Even google let this do the enduser by hand - so automating this might be hard)
Domain is free: Register it, configure the CNAME yourself (you own it)
If you only want a redirect, the user can upload a html file or .htaccess file, that performs the redirect. But this has to be done by the customer, too.

Resources