0

I'm trying to restrict access to the Bitnami WordPress(with apache) dashboard to VPN access only.

The current environment is below.

The WordPress site

  • The site build by AWS Lightsail WordPress instance.
  • The site has a static public IP(aaa.aaa.aaa.aaa).
  • The site also has a domain name(bbb.com).
  • The site has joined a VPN network(using OpenVPN).
  • The site has a static VPN address(ccc.ccc.ccc.ccc)

My development machine

  • The machine is MacOS(11.4).
  • A using browser is Safari(14.1.1).
  • The machine has joined the VPN network and a static VPN address(ddd.ddd.ddd.ddd).
  • The machine uses Tunnelbrick to join the VPN network.
  • The machine has also a public IP address that is non-static(because the machine has access to the internet via mobile access).

The VPN network

  • This VPN server uses OpenVPN.
  • The VPN server build on my private machine.
  • The VPN server has a static public IP(eee.eee.eee.eee).
  • The VPN server has also a static VPN address(fff.fff.fff.fff).

So, I configured the file /opt/bitnami/apps/wordpress/conf/htaccess.conf of the WordPress like below so that the access from the machine is allowed and restart apache.

<Directory "/opt/bitnami/apps/wordpress/htdocs/wp-content/plugins/akismet">
# Only allow direct access to specific Web-available files.

# Apache 2.2
<IfModule !mod_authz_core.c>
Order Deny,Allow
Deny from all
</IfModule>

# Apache 2.4
<IfModule mod_authz_core.c>
Require all denied
</IfModule>

# Akismet CSS and JS
<FilesMatch "^(form\.js|akismet\.js|akismet\.css)$">
<IfModule !mod_authz_core.c>
Allow from all
</IfModule>

<IfModule mod_authz_core.c>
Require all granted
</IfModule>
</FilesMatch>

# Akismet images
<FilesMatch "^logo-full-2x\.png$">
<IfModule !mod_authz_core.c>
Allow from all
</IfModule>

<IfModule mod_authz_core.c>
Require all granted
</IfModule>
</FilesMatch>
</Directory>
<Directory /opt/bitnami/apps/wordpress/htdocs/>
<Files wp-login.php>
order deny,allow
deny from all
allow from ddd.ddd.ddd.ddd
</Files>
</Directory>

With this setup, I tried to access the wp-login.php of the site by typing https://bbb.com/wp-login.php into my browser. This access was denied (I got a 403 error), which is OK. Next, I typed the address https://ccc.ccc.ccc.ccc/wp-login.php, which contains the VPN address, into my browser to access it using the VPN. However, this brought up the login page, but after entering my username and password, I got a 403 error.

How do I configure the file to allow only VPN access to the dashboard page?

Of course, you can also tell me another way to make the dashboard page accessible from only my machine.

Please help me.

Update

I added |wp-admin to <Files...> like below.

<Directory /opt/bitnami/apps/wordpress/htdocs/>
<Files wp-login.php|wp-admin>    <------- change this line.
order deny,allow
deny from all
allow from ddd.ddd.ddd.ddd
</Files>
</Directory>

But it doesn't work.

Update2

I know the order, allow, deny directives are deprecated from Apache 2.4 now. So I made some modifications to the htaccess.conf like below.

<Directory /opt/bitnami/apps/wordpress/htdocs/>
<FilesMatch  "wp-login.php|wp-admin">   <-------use FilesMatch directive instead of Files directive and surround wp-login.... with ""
  Require ip ddd.ddd.ddd.0              <-------allow access from all ip addresses that have ddd.ddd.ddd
</FilesMatch>
</Directory>

Now, access to https://ccc.ccc.ccc.ccc/wp-admin gets 403 directly. I think it's correct because I have not logged in yet. And access to https://ccc.ccc.ccc.ccc/wp-login.php gets login page, but enter the username and password then gets 403.

Update3

I rewrote the access control part of htaccess.conf like below.

<Directory /opt/bitnami/apps/wordpress/htdocs/>
    <FilesMatch  "wp-login.php">
        Require ip ddd.ddd.ddd
    </FilesMatch>
</Directory>
<Directory /opt/bitnami/apps/wordpress/htdocs/wp-admin/>
    Require ip ddd.ddd.ddd
    <Files admin-ajax.php>
        Require all granted
    </Files>
</Directory>

And, I accessed the site by typing https://ccc.ccc.ccc.ccc/wp-login.php. But it got 403. So, I checked the logfile /opt/bitnami/apache2/logs/error_log. The error-log is below. I found the WordPress server is accessed from unknown client IP xxx.xxx.xxx.xxx when I accessed wp-login.php. The unknown client accessed from the various ports. This is not the VPN address of my machine, and I don't know this IP at all. How do I fix the client IP to my machine's VPN IP?

[Mon Aug 02 01:07:22.870836 2021] [authz_core:error] [pid 13775:tid 139911143339776] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/js/user-profile.min.js, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:07:22.879926 2021] [authz_core:error] [pid 13777:tid 139911134947072] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/css/forms.min.css, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:07:22.913148 2021] [authz_core:error] [pid 13777:tid 139911126554368] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/css/login.min.css, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:07:22.959986 2021] [authz_core:error] [pid 13777:tid 139911092983552] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/js/password-strength-meter.min.js, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:07:24.081698 2021] [authz_core:error] [pid 13777:tid 139911118161664] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/css/login.min.css, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:07:24.089285 2021] [authz_core:error] [pid 13777:tid 139911067805440] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/js/password-strength-meter.min.js, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:07:24.090565 2021] [authz_core:error] [pid 13775:tid 139911059412736] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/css/forms.min.css, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:07:24.100000 2021] [authz_core:error] [pid 13777:tid 139911109768960] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-admin/js/user-profile.min.js, referer: https://ccc.ccc.ccc.ccc/
[Mon Aug 02 01:09:03.689521 2021] [authz_core:error] [pid 14111:tid 139911109768960] [client xxx.xxx.xxx.xxx:xxxxx] AH01630: client denied by server configuration: /opt/bitnami/apps/wordpress/htdocs/wp-login.php, referer: https://ccc.ccc.ccc.ccc/

Update4

I checked the access log /opt/bitnami/apache2/logs/access_log. The part of the log is below.

ddd.ddd.ddd.ddd - - [04/Aug/2021:02:48:17 +0000] "GET /wp-login.php HTTP/1.1" 200 2624
xxx.xxx.xxx.xxx - - [04/Aug/2021:02:48:30 +0000] "POST /wp-login.php HTTP/1.1" 403 199
ddd.ddd.ddd.ddd - - [04/Aug/2021:02:48:36 +0000] "-" 408 -
xxx.xxx.xxx.xxx - - [04/Aug/2021:02:48:50 +0000] "-" 408 -

Then I found that the get request to fetch wp-login.php is conducted by using the IP ddd.ddd.ddd.ddd. But the post request(This may post the username and the password to the WP) is conducted by using the unknown IP that is mentioned above. And I found the unknown IP is my mobile router's global IP. Eventually, this problem is caused by some VPN miss-configuration.

Improve this question
9
  • There doesn't appear to be anything in what you've posted that would trigger this 403 (except if there is an issue with IP addresses)? If you want to restrict access to the dashboard then you also need to restrict access to the /wp-admin subdirectory - which you are not restricting at all currently (so no 403 would be expected). You are also using Apache 2.2 directives - I would expect you to be on Apache 2.4? (Did you write the akismet directives?)
    – MrWhite
    Jul 28, 2021 at 9:19
  • Thank you for your reply. The modification I did is just adding the last 7 lines(deny and allow rules) to htaccess.conf and others had been written at first. But the modification has no effect(Just in case, I added also |wp-admin to <Files ...>). This is my first time using Apache as well as Bitnami WordPress. This environment has some configuration files(bitnami.conf, htaccess.conf, httpd.conf, and others..?) so I don't understand which file to modify and how to modify it. The version of Apache is 2.4.46.
    – Pierogi
    Jul 29, 2021 at 4:52
  • "I added also |wp-admin to <Files ...>" - that is not valid Apache syntax. The <Files> container only matches files, not directories. But attempting to do anything like that at this stage is only compounding the problem. As I stated above, there should be no 403 with the code you posted above so you need to find out why you are getting a 403 here. Check the network traffic and the requests reaching your server (IP addresses etc.). If WP is making an AJAX request on the domain then that would seem to be rejected by what you've stated in the question. (?)
    – MrWhite
    Jul 29, 2021 at 12:49
  • How about the file "admin-ajax.php"?(For example, this site explain about the file. In my guess, this file might be making an AJAX request when the user logs in. I don't know how to know its behavior. What do you think about this?
    – Pierogi
    Jul 30, 2021 at 9:30
  • Yes, admin-ajax.php will need to be accounted for in order to restrict access - but this is part of /wp-admin. However, you are getting a 403 when only blocking wp-login.php. In the code you posted above, /wp-admin (and admin-ajax.php) has unrestricted access. So, something would seem to be requesting wp-login.php from an IP address you are not expecting.
    – MrWhite
    Jul 30, 2021 at 17:07

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.