CP access: admin.php or system/index.php

Question

A site that I built last autumn had the CP url set as system/index.php (I think I was following Ryan Irelan’s advice in that regard). It works fine. However, last night I did a quick install of EE Core and the bit of the installation wizard specifying ‘URL to your control panel access file’ pre-filled itself with admin.php. Either method seems to work (provided I appropriately specify the $config['cp_url'] parameter in my config.php file) but I am left wondering which is the ‘correct’ way? mydomain.com/system/index.php or my domain.com/admin.php? And is one way more secure than the other?

Answer 1

It's not that using admin.php is a security benefit in itself, it's that it allows you to move your entire /system folder outside of the web root. If you don't take that step then you will see no benefits whatsoever. In fact, if you leave both admin.php and /system in your public_html folder (or equivalent) that's arguably detrimental to security, as you've got two separate CP logins for people to stumble across rather than one.

Why move your system folder out of the web root?

It's a bit like living in an underground bunker rather than a normal house. Instead of having a ton of doors and windows for someone to throw a rock through you've just got the one. If there's an XSS exploit for system/expressionengine/third_party/dodgy_addon/mcp.dodgy_addon.php you aren't vulnerable to it as that file isn't publicly accessible. Any successful hack has to be routed through admin.php*.

Should I always move the system folder out of the web root?

Ideally yes, but you won't always have a choice over server environments or deployment practices, and sometimes it might not be feasible. So long as /system has been renamed it probably isn't worth losing sleep over, but if you have the option it's always worth doing.

_{* Short of server-level exploits which are really a separate issue.}

Answer 2

I believe the main and immediate advantage to using admin.php, wether you move the system folder above root or not, is that it hides the name of the system directory from http request logs. So if you have renamed your system folder (for security reasons), your browser is only making requests to admin.php, not secret_system_folder/index.php.

It's the same reason why when you click the name of your site in the upper right corner of the control panel, you're taken to http://example.com/index.php?URL=http://example.com. I believe this is to mask the referrer URL in server logs from recording your system folder.

Answer 3

You need to use admin.php when using MSM (Multi Site Manager). The system folder is only present in one of the sites so if you want to access the Control Panel from one of the other sites you have to use admin.php.

First site in MSM looks like:

/
index.php
admin.php
-System
-Templates
etc

Each subsequent site just has:

/
index.php
admin.php
-Templates
etc

You can access the Control Panel for any site in the MSM from the master (for want of a better term) site via /system/index.php, in which case you don't need admin.php, but if you limit user's access to just one, or rather not all, sites then you will need to provide admin.php as the entry point to the control panel for each site.

EE Security is what you make it - /system/index.php can be secured simply by dropping in an .htaccess file and restricting by IP or something similar. We tend to have our control panels only accessible from within our network and we can achieve this using either file. We also remove everything but the front controller (index.php/admin.php) and static assets from the public web root - but that's the answer to another question :)

Answer 4

It depends on your needs. First, when changing the name of your system folder, also change the name of the admin.php file, if you plan to use. If not, delete the admin.php file.

Our go to set-up for ExpressionEngine installs are to move the system folder out of the 'public_html' folder (aka: html, www, public, etc.) So if your set-up is more like

/system
/public_html
   - admin.php

Then you want the admin.php file.

We do have old set-ups where /system is in the public_html folder. In those cases we:

1. Remove 'admin.php' if all control panel users are client's staff. If everyone with control panel access is also considered a trusted source (staff), then we delete the 'admin.php' file, but…

2. Establish Multiple Levels of Trust with 'admin.php'. In these cases, we may provide only sysadmins or designated staff access to the full system folder and provided everyone else access via the admin.php file. Users of the admin.php file, generally wouldn't have ssh or ftp access either, so they NEVER know the name of the system folder.

Our biggest use though is for using admin.php when the system folder no longer has public access. A good security measure, if you can do it.

Answer 5

I personally never use admin.php. I delete it from installs altogether if I do not move system folder above web root. I do not use it with MSM installs either. The only ones I have got only allow for access via the "main" domain.

One less thing to worry about ;o)

EDIT:

That being said, here is a great ebook on securing ExpressionEngine by Mark Huot. Well worth the money/read. If possible, moving your system folder above web root is more secure, as others have indicated.

Answer 6

I like to have as little in the webroot as is humanly possible.

So i always have the system folder above webroot, and i always rename the admin.php file to something random that obviously the client will have to know as it is their only route in to the admin area.

Of course, those things aside, it is equally as important to make sure that you only use third party add-ons from trusted developers as a poorly written add-on will make all your hard work for nothing if someone can just attack you via the front controller anyway by exploiting a bad add-on.

As well as that, make sure your file permissions are locked down, your php version is kept up to date (i don't mean use php 5.5 or whatever, but just the latest php 5.3.x at the moment) and your server is locked down with a firewall if possible. These things will offer greater protection from nefarious types than just moving and renaming your system folder.