I want to add 2 step Authentication to an admin back end URL to my clients online Magento shop. I don't want to use a google app authentication or a phone app/sms system. I want a master Username/Password for the first step then my usual admin accounts.
I've been googling for a while but can't find anything except for SMS/App authentication, is there some other way I'm missing?
It seems you want to add a .htaccess directory protection.
Ad there is no real admin folder, you need to work around this:
SetEnvIfNoCase Request_URI "^/admin/" ADMIN
AuthType Basic
AuthName "Magento Admin"
AuthUserFile /path/to/.htpasswd
Require valid-user
Satisfy any
Order allow,deny
Allow from all
Deny from env=ADMIN
Just add the usernames + passwords in the .htpasswd file and your're good to go.
You may also want to think of a solution like this where only certain IPs are allowed to access your admin URL:
RewriteCond %{REQUEST_URI} ^/admin/(.*)$
RewriteCond %{REMOTE_ADDR} !^111.112.113.114$ #your IP
RewriteRule ^(.*)$ - [F,L]
it's an old topic but I was looking for something like that and found it
first, thanks Anna for your answer, it helped me
but I see 2 problems:
so I use "/admin" instead (except I don't use "admin", see below)
so yes, frontend URL containing "/admin" will be caught but remember that we are talking of the "admin" token only if you chose to let "admin" as identifier to your admin panel
you should change this identifier and put something harder to find and that you won't get in frontend
and code for Apache 2.4:
SetEnvIfNoCase Request_URI "/[your admin identifier here]" ADMIN
AuthType basic
AuthName "Restricted Access"
AuthUserFile [path to your .htpasswd here]
<RequireAny>
<RequireAll>
Require env ADMIN
Require valid-user
</RequireAll>
<RequireAll>
Require not env ADMIN
Require all granted
</RequireAll>
</RequireAny>
