You are using an alternate directory for the AdminCP. Support for this has been removed for v5.

[PoC2]

The page said to come here. 🙂

So will this be an automatic change on upgrade or will I need to do something with my current AdminCP location beforehand?

Out of interest, why has this facility been changed for V5?

Many thanks.

[Jim M]

We would recommend removing the constant and ensuring the admin folder is uploaded. Other than that, no modification is needed.

1 hour ago, PoC2 said:

Out of interest, why has this facility been changed for V5?

Security through obscurity isn't the best method of security. Now with such advancements with Multi-Factor Authentication, it's not really necessary and is just bulk in our codebase.

[PoC2]

10 minutes ago, Jim M said:

Security through obscurity isn't the best method of security.

It's still a very good additional one.

Nature uses it A LOT.

[Randy Calvert]

2 hours ago, PoC2 said:

It's still a very good additional one.

Nature uses it A LOT.

You can also use a firewall or htaccess to limit access via IP address.  Simply renaming it does not help stop any kind of real attack.  Web scanning tools can find renamed folders relatively easily in today's world.  If you really want to protect the ACP more, use 2FA and a firewall to limit access.    

Edited Tuesday at 08:23 PM by Randy Calvert

[PoC2]

Already have those as well.

[Jim M]

21 minutes ago, PoC2 said:

Already have those as well.

Would not be concerned then with this change as you already deploy more secure methods than this could offer.

[Daddy]

11 hours ago, Jim M said:

Security through obscurity isn't the best method of security. Now with such advancements with Multi-Factor Authentication, it's not really necessary and is just bulk in our codebase.

If this is the case, why did Invision change their admincp location from default?

[riko]

"We would recommend removing the constant and ensuring the admin folder is uploaded."

I remember somewhere to have hidden the admin folder at some point, somehow.
My question would be how and where do I undo this (Also when?) and where exactly is this remove setting for this "constant"?

 

[Marc]

2 hours ago, riko said:

"We would recommend removing the constant and ensuring the admin folder is uploaded."

I remember somewhere to have hidden the admin folder at some point, somehow.
My question would be how and where do I undo this (Also when?) and where exactly is this remove setting for this "constant"?

 

Its set in your constants.php file

4 hours ago, Daddy said:

If this is the case, why did Invision change their admincp location from default?

While I appreciate the attempt, you're actually incorrect. Just because you cant access it, doesnt mean its not present

[Daddy]

13 hours ago, Marc said:

While I appreciate the attempt, you're actually incorrect. Just because you cant access it, doesnt mean its not present

I mistook the default for admincp instead of just admin. My mistake on that one. But regardless of the point, security through obscurity is a fantastic layer of security and one that should not be removed. Sure, you can block the page in your firewall or Cloudflare rules, but there's no easy way to make this dynamic. Anytime you add or remove a user with ACP access, you now have to whitelist their IP, many of which are dynamic and change every other day.

It’s simple enough to keep and is especially useful for adding an extra layer of security to your suite. If you truly think obscurity isn’t a secure measure, let me introduce you to steganography! (Directed at Jim)

[Randy Calvert]

21 hours ago, Daddy said:

If this is the case, why did Invision change their admincp location from default?

They’re using a firewall to restrict access to the resource.  This is MUCH more secure than simply renaming the folder. 

[Marc]

9 hours ago, Daddy said:

I mistook the default for admincp instead of just admin. My mistake on that one. But regardless of the point, security through obscurity is a fantastic layer of security and one that should not be removed. Sure, you can block the page in your firewall or Cloudflare rules, but there's no easy way to make this dynamic. Anytime you add or remove a user with ACP access, you now have to whitelist their IP, many of which are dynamic and change every other day.

Which is why we advise on 2 factor authentication. Although, I have to be honest, if you have that many coming and going admin, you have more issues with security than hiding a folder

9 hours ago, Daddy said:

If you truly think obscurity isn’t a secure measure, let me introduce you to steganography! (Directed at Jim)

Stenagraphy - Noun - the practice of concealing messages or information within other nonsecret text or data.

I'm not actually sure the defininition of Stenagraphy states it is a secure measure. However, lets skip past that part and assume it absolutely is.

What my colleague stated was "Security through obscurity isn't the best method of security." This is not in any way the same sentence as "security isnt a secure measure". Its probably not wise to misquote people, as it can cause confusion for others, and lead them believe we have said things that we actually haven't.

What Jim said there is correct. Its not the best method of security. No matter whether or not you want to have security by obscurity or not, it doesn't make it the best method.

Listen, we get it. You would prefer to have this option. However this has now already been removed in version 5, and we advise on 2 factor authentication.

[Matt]

Invision Community 5 is a fresh start on many things, and we wanted to remove a lot of old features with roots back into the early 2000s.

Security through obscurity was pretty much all we had back then, but now there are better tools including firewalls, 2FA and VPN/IP address restriction.

I'd always recommend 2FA for all admin accounts.

Just hiding the admin folder is a weak way to secure it. It means that if you accidentally paste the link, or it appears as a referrer in access logs or someone figures out the folder name then you've lost that element of security. It's a bit like locking the door and placing the key under the plant pot.

I know all these changes can be overwhelming which is why we're making every effort to communicate them to you and give you as much runway as possible to migrate over.

[Daddy]

1 hour ago, Marc said:

Which is why we advise on 2 factor authentication. Although, I have to be honest, if you have that many coming and going admin, you have more issues with security than hiding a folder

Stenagraphy - Noun - the practice of concealing messages or information within other nonsecret text or data.

I'm not actually sure the defininition of Stenagraphy states it is a secure measure. However, lets skip past that part and assume it absolutely is.

What my colleague stated was "Security through obscurity isn't the best method of security." This is not in any way the same sentence as "security isnt a secure measure". Its probably not wise to misquote people, as it can cause confusion for others, and lead them believe we have said things that we actually haven't.

What Jim said there is correct. Its not the best method of security. No matter whether or not you want to have security by obscurity or not, it doesn't make it the best method.

Listen, we get it. You would prefer to have this option. However this has now already been removed in version 5, and we advise on 2 factor authentication.

I'm not trying to beat anyone up over this, but I don't see how the coming and going of those with admin access is relevant to security. Not everyone with ACP access has full access. We utilize the in-depth permission system to give team members certain scopes to work with. But even with a small team that rarely changes, their IP will change quite often, which means using a firewall to block access will be impossible without some type of custom integration.

2FA does solve the problem, but I (and I'm sure others) would prefer not to have the page accessible to anyone. Given IPS is a well-known software, the default location is easily accessible and is a very common path that many other CMS's use. It would make me feel better being able to set a unique name so people can't stumble upon it, even if it's secure.

Was there any particular reason this feature had to go? I agree it didn't make much sense in regards to security, but it didn't hurt? I feel like the usefulness of this was underestimated when this was decided upon. The lack of a deprecation warning until now seems a bit odd as well. Surely this is going to be overlooked up until IPS5.