TYPO3 block IP addresses

Question

Somebody tried to get access to my TYPO3 backend. I already have the IP adress of the attacker and want to block it from the backend.

I already tried to block ip with .htaccess but this doensn't work. I think the rules are overwritten by something else in the .htaccess file which I couldn't figure out yet.

Captcha is at the moment not a suitable solution.

Are there any good extensions for blocking IP adresses or is there another way to avoid these brute-force attacks?

Answer 1

You should block requests before PHP/MySql is in use in the best case. So .htaccess is the correct way in my eyes. If it does not work, you should ask your hoster.

Answer 2

It sounds like you want to block the IP of the attacker and put measures in place to block known bad ip's. One of the main issues with blocking the IP of the attacker is that it's fairly easy for an attacker to setup a new IP address and launch a new attack.

There are services that provide lists of known bad ip's if you wanted to implement your own firewall.

Alternatively you can look to place your URL behind a solution such as Cloudflare that have the ability to block IP's or countries. I know of business's that block traffic from China and Russia since they identified that most of their attacks came from these countries.

Answer 3

If you are really concerned about somebody to be able to successfully get access to the system I suggest to go the "white list" path instead of blacklisting single IPs. TYPO3 has a built in feature to block backand access for ALL IPs except some white listed ones.

To do this just add the following into AdditionalConfiguration.php putting your own IP and the IPs (or subnets) of other users too.

$GLOBALS["TYPO3_CONF_VARS"]['BE']['IPmaskList'] = 'x.x.x.x,y.y.y.*,z.z.*.*';

Other than that, just make sure you take the basic steps to make your backend more secure:

1) Force SSL for the backend:

$GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSL'] = 2;

2) Implement a secure password policy for the backend users by using e.g. EXT:be_secure_pw

3) Secure session cookies to have ssl_only and http_only attributes:

$GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieHttpOnly']=1;
$GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieSecure']=1;

4) And last but not least: make sure you are using the most recent version of your TYPO3 version line, ideally a maintained LTS version.