Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Pro Tip : Use IIS URL Rewrite To Prevent Login.aspx AccessPro Tip : Use IIS URL Rewrite To Prevent Login.aspx Access
Previous
 
Next
New Post
4/12/2015 10:58 AM
 

Solved an interesting DNN challenge this morning and thought I'd share in case anyone else runs up against the same issue and finds this useful.

We have a number of public only no registration websites and have noticed in the event logs that we were getting a lot of failed login attempts despite the fact that the site settings user registration is set to none and no login link appears anywhere on the site.

Which means someone or something is hitting login.aspx or using the ?ctl=login query string directive to access the login page.

You'd think the solve for this would be to create a login page without a user login module on it and set that as the site's login page -- but DNN, for some good reasons, does not permit setting a page without a login module on it.

Here's a solve if you host your own server...

Create a custom login page with the login module with a hard to guess URL (something like dnnlogin343824093 for example.) Just be sure not to name it with anything starting with the string "login" -- the reason why will be evident shortly. Then set the page to not appear in the menu and also deselecting the index checkbox in page settings, advanced settings, other settings so the page will not appear in the site map and/or be indexed by search engines. Do not set this page to the site login page leave the default so that DNN will use login.aspx.

Finally install Microsoft's excellent url rewrite 2.0 on the server [http://www.iis.net/downloads/microsoft/url-rewrite], access the site via IIS manager and create a url rewrite rule to 301 redirect login* (wildcard) to any url you'd like. Since the site is set to use the default login page this will also catch the ?ctl=login requests when they are redirected.

 

Best regards,

 

Dave Abad

www.logalt.net

 

 

 

 

 

 

 
New Post
4/18/2015 11:42 AM
 
thanks for the tip. FYI you can use the built in filtering capability as well if you wish to block access (see http://www.dnnsoftware.com/wiki/repla... which shows how to do so for the register page)

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US
 
New Post
4/13/2016 2:21 AM
 
Thanks David for the tip, to add to your post, I created a rewrite rule in the URL Rewrite module in IIS 8 and it created a entry in the web.config file, alternatively one can insert the below entry in the web.config file:
      <rules>
     
<rule name="Block Login" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*login*" negate="false" />
                    <conditions>
                        <add input="{URL}" pattern="*login*" />
                    </conditions>
                    <action type="AbortRequest" />
        </rule>
      </rules>
       
         
         
           
         
         
       
                   
                   
                       
                   
                   
       
     


 

 












 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Pro Tip : Use IIS URL Rewrite To Prevent Login.aspx AccessPro Tip : Use IIS URL Rewrite To Prevent Login.aspx Access


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.

Content Layout

Subscribe to DNN Digest

Subscribe to DNN Digest

DNN Digest is our monthly email newsletter. It highlights news and content from around the DNN ecosystem, such as new modules and themes, messages from leadership, blog posts and notable tweets. Keep your finger on the pulse of the ecosystem by subscribing.  


Copyright 2017 by DNN Corp Terms of Use Privacy
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out