Admincp on a different machine?

[kjkoster]

Dear Paul M,

I meant to say that the regular forum mysql user should not have CREATE/ALTER/DELETE privileges and the administrative site should. My bad.

As for the password protecting, that would not allow me to lock down the database user for vbulletin.

Plus (and you don't know this of course) I have a lot more running on that admin machine than just the vbulletin forum. That machine also runs the monitoring for instance. I hang out of the admin machine more than on for forum. For me it is more logical to have all that on one machine, while for most forums it is more logical to use the default setup of having admin tasks on the forum machine as well.

Kees Jan

[Paul M]

Im pretty sure you need DELETE for the forum to run properly, not sure about ALTER/CREATE.

[Angel-Wings]

Well - conclusion first - this is maybe useless. The problem is that the second (your Admin machine) would need the SQL rights you want to take away in order to do administrative tasks.
To write them in the DB of your first machine, you either have to setup a replica - the replica user would then have the rights you want to take away or some kind of tunnel - then again the problem remains the same.
At least INSERT / SELECT is required to run Vbulletin and that's already enough to dump the passwords or add another admin to your forum - if there's an injection possible.
I just want to say that all this might not give the security enhancements you're looking for because at least one DB user needs to rights at your VB database.
Maybe, rename the AdminCP folder, add a Password Protection and if you want to lookdown IP's do it directly in the Webserver configuration.
Or move your AdminCP - at the same server - inside a SSL environment setting up a redirection, Client Cert Authentication is the key.

Like said, DB access is still required with the rights you care about, doesn't matter where your AdminCP is placed. IP's can be spoofed as well so the time is maybe better spent configuring your primary machine that injections are already as hard as possible. Moving something insecure away doesn't make it more secure anyways if there's a problem because even at the other machine, the security problems, if any, will stay.

[kjkoster]

Dear Angel-Wings,

Hmm. Excellent points. Certainly food for thought. This is beginning to sound like less and less of a good idea. Thanks for you advise.

Kees Jan