Admin Login, Security Login Key Generator

[systeman]

Admin security has always been an issue and there have been many ideas on this.

Here's my idea which I think is super duper:

During the installation process there is an email address field in the website Mail setting. This is written to the configuration.php file and usually used as the default email address for communicating with admin and site membership registration.

My idea is this:

There could be a second field for another email address. But email address is tied to the originating installation (admins) ip address and encrypted. It is then saved to a randomly generated and named directory and file in root. Only the adminstrator will know the directory and file name which can be blocked in the robots.txt file.

Obviously there has to be a way for admin to change their IP address as and when they need to, for example: they might move to another computer.

In the directory there could be a script that kicks in when admin browses to their website/security-folder-name. A login key is emailed to admin via the encrypted email address and action via the script.

Sequence Events For Logging In:
Admin enters their URL: website/administrator/security-folder-name and hits enter. A splash screen informs admin "Your randomly generated login key has been emailed".

Admin then waits a few seconds for the email with the login key.

Admin then copies the key and pastes it at the end of the url, and hits enter to go to the admin side of their Joomla installation.

The idea is to do away with the usual login URL completely.
Anyone entering website-name/administrator sees a splash screen "Access to this URL is Security Protected. You need an Admin key to login".

Got to be a good idea, yeh?

[sitesrus]

There's already extensions available for brute force, keys, key value, many things like that.

You can check in the joomla extension directory.

[stutteringp0et]

Addition to this old thread. There is a misconception about what robots.txt does. It does not prevent robots from accessing the listed URLs. Any robot that obeys the rules will know not to visit those URLs, however, a robot that does not obey the rules may look at robots.txt as a list of must-see pages.

So, robots.txt isn't a security feature - it's just a text file.