How to make admin site safe ?

Question

Hi guys,

very simple question: I have admin site in my web project. So, how can I make it safe?

What I have until now:

• Database handled user with userID and userlevel
• on the pageload of the admin master page (which includes all admin sites) there is a clause to check if userID is okay (get the user from database) and if userlevel is right
• If Not, redirect to Default.aspx with normal master page
• if yes, go trought

How safe is it really?

---

Edit:

• The userID is saved in a session on the server.
• There is no way to save the login (no cookies).
• The user must login to get the userID in the session
• The login is saved in a database table user_log with username, password, ip, loginsucceeded and userID

Answer 1

We use integrated windows authentication.

1. In IIS manager, click the "Directory Security" tab
2. Uncheck "Anonymous Access"
3. Check "Integrated Windows Authentication"

This lets you administer who has rights to your admin site by modifying domain accounts instead of using a roll-your-own solution. You can still get the logged-in user's credentials via the Environment class, which can be used to associate any web-specific properties for each user that you want to store in your database. This also has the advantage of automatically handling timeouts, relogin requirement if browser was closed, etc.

Your solution looks almost fine, though it sounds as though you're adding individual user accounts to the SQL server instead of handling everything through the ASP.NET service account login. I'd avoid adding individual user accounts into your database. In ASP.NET, unless you're jumping through some useless hoops, the ASP.NET service account is what is authenticated for DB connectivity, not the user that's logged into the site.

Answer 2

The basic idea looks ok. It all comes down to how you are getting that UserID to make the checks against. If the userID is being passed as a querystring, then that is very bad. If it is stored in a session via sometype of pre authorization then it is better. If you are using SSL, IP checking, etc it will improve your level of security.

The main thing is HOW you are getting the userID to verify against. That is where the exploit will occur. Secure that process and you should be ok with your setup.

Edit: Based on your update this looks ok but it also depends on how secure you really need this to be. How secure is your sign in page? Are you using SSL? Any worries about session highjacking? Why not store an IP with the userID and verify the request IP against the stored IP when doing the UserID fetch from the session?

There are so many security solutions out there. You need to decide how far you need to safely go to ensure the level of security that is necessary for your particular application.