Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The admin page is a page which allows me to access the database of my website. Of course, there will be a login screen there but I want to take measures that no one besides me will even ever see this page.

I'm using asp.net on a VPS.

So in my understanding, it should be sufficient to give the admin login page a complicated name so it can be accessed like this mysite.com/ie63xk...kig.aspx.

My question is: If I dissallow directory browsing and there is no link pointing to the hidden admin page, is there any way for a human / bot / search engine to locate this page?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you disable directory browsing and ensure there are no links to your admin logon page then yes, people won't know about it. BUT this is a really unwise thing to rely on: security through obscurity. Access to this secret page can be discovered through your browser history, proxy logs, your web server logs. It can also be leaked out in the form of the referral header; lets say you have an external link on your secret admin page.

I would recommend focusing your efforts on securing your logon screen rather than stopping people knowing about it. If your username, password, and your login screen code is up to scratch it doesn't matter if somebody comes across it.

An additional layer of security that you could adopt would be to filter access to the logon screen to certain IP addresses. This is easily done in ASP.NET.

In summary, the answer to your question "is there any way for a human / bot / search engine to locate this page?" is no.

share|improve this answer
1  
And of course, perform an authentication check on every admin page. Don't do what one client of mine did whereby they had a super secure admin logon screen (with one password, and an additional "pass phrase" per user) which simply redirected to /controlpanel.aspx if the credentials were good, and /badlogin.aspx if they were bad. But if someone bookmarked a certain admin page or entered the URL directly, they got free access ... doh! –  Ross Wilson Sep 14 '10 at 19:33

The normal way is to password protect the directories. So you will have another login just to see the page.

This will definitely secure the page from human/bot/search bot, probably best in vps to use forms authentication mode.

share|improve this answer
    
That would be protecting a login with another login so the first login could be spammed as well... What I want to know if is there is any way to reveal such a 'hidden' page without using brute force of course... –  tom ruri Sep 14 '10 at 14:59
1  
Yes and no. Even if YOU have no link nowhere, some idiot admin may have a link on a hidden page somewhere that then gets parsed. Relying on this without login is asking fo a desaster. Point. –  TomTom Sep 14 '10 at 16:49
    
hmm don't know what your problem is guys... I clearly stated that I use a normal login on that page... I just want it to be invisible to the world as a second line of defense... I'm also the only one who will use the admin page... hope this clarifies some things :D Oh well, I'm not sure if you event meant me with your comment, TomTom –  tom ruri Sep 14 '10 at 17:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.