Question

How can i restrict access to the admin/ section of my website? I can’t limit it by IP address because we need to sometimes access the admin/ section from remote client locations (when giving a demo, etc).

there is of course, an admin username/password – but what else can i do?

Answer 1

Most applications just use a username/password for access control, and that’s generally sufficient. Some that require extra security use two-factor authentication, which might mean using a token that you carry with you (e.g. a device that generates a token that’s kept in sync with a server) or a token that is sent to you (e.g. the system sends a text message to your phone with a token that you have to type in in addition to your password).

An easier option is to authenticate using a client certificate; you can carry the cert around with you on a thumb drive in case you’re at a remote location (just remember to remove the certificate from the remote machine when you’re done).

Here’s a nice write-up on client certificate authentication.

Another option is to only allow connections from your local network, and then use VPN to join a remote machine to a local network.