# How best to secure admin directory?

**URL:** <https://www.ruby-forum.com/t/how-best-to-secure-admin-directory/186576>\
**Category:** NGINX\
**Created:** [April 9, 2010, 3:48am UTC](https://www.ruby-forum.com/t/how-best-to-secure-admin-directory/186576 "2010-04-09T03:48:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leonardocg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e274bd/32.png) [@leonardocg](https://www.ruby-forum.com/u/leonardocg)\
**Post date:** [April 9, 2010, 3:48am UTC](https://www.ruby-forum.com/t/how-best-to-secure-admin-directory/186576/1 "2010-04-09T03:48:07Z")

</div>

Morning guys!

Can anyone help with best practice to secure an /portal/admin  
directory? A link to documentation will do just fine.

Our website has and /admin directory which don’t want to be accessible  
via [www.domain.com/portal/admin](http://www.domain.com/portal/admin). Instead, we want [hackoff.domain.com](http://hackoff.domain.com)  
to point to /portal/admin directory. If we could add authentication to  
[hackoff.domain.com](http://hackoff.domain.com) would be great too.

The point is some files on [www.domain.com/\*](http://www.domain.com/*) include (php include)  
files on /portal/admin, so this has to work internally.

I searched the wiki and this website [Nginx Secure SSL Web Server @ Calomel.org](https://calomel.org/nginx.html)  
(which is great too) but I couldn’t figure out a way to do this.

Any ideas are very welcomed.

Cheers!

---

<div class="post-metadata">

**Author:** ![leonardocg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e274bd/32.png) [@leonardocg](https://www.ruby-forum.com/u/leonardocg)\
**Post date:** [April 9, 2010, 4:12am UTC](https://www.ruby-forum.com/t/how-best-to-secure-admin-directory/186576/2 "2010-04-09T04:12:43Z")

</div>

On 09/04/2010 03:47, Leonardo C. wrote:

> Morning guys!
> 
> Can anyone help with best practice to secure an /portal/admin  
> directory? A link to documentation will do just fine.
> 
> Our website has and /admin directory which don’t want to be accessible  
> via [www.domain.com/portal/admin](http://www.domain.com/portal/admin). Instead, we want [hackoff.domain.com](http://hackoff.domain.com)  
> to point to /portal/admin directory. If we could add authentication to  
> [hackoff.domain.com](http://hackoff.domain.com) would be great too.

I’m not sure it’s a “great security”. There is a lot of spywares in  
browsers (the Google Toolbar for example) which will inform about the  
used address.

> The point is some files on [www.domain.com/\*](http://www.domain.com/*) include (php include)  
> files on /portal/admin, so this has to work internally.

Outch. I hope your “php includes” doesn’t use HTTP to load files…

---

<div class="post-metadata">

**Author:** ![leonardocg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e274bd/32.png) [@leonardocg](https://www.ruby-forum.com/u/leonardocg)\
**Post date:** [April 9, 2010, 5:21am UTC](https://www.ruby-forum.com/t/how-best-to-secure-admin-directory/186576/3 "2010-04-09T05:21:12Z")

</div>

> I’m not sure it’s a “great security”. There is a lot of spywares in browsers  
> (the Google Toolbar for example) which will inform about the used address.

That’s true… would you recommend just having authentication on that  
location instead?

> Outch. I hope your “php includes” doesn’t use HTTP to load files…

It doesn’t, they’re all include(); directives.

Cheers Oliver!

Leo