Manager access prevention

Is there a way to prevent access to the manager from the outside? I will be putting the webserver on our DMZ and I am trying to think of a way to prevent access to the manager portion to the outside world. Any suggestions? Is there a way to put the manager portion on a different port?

This will be much simpler in 095... coming very soon, or check out the latest SVN trunk. Scratch that and let me rethink.

I need to do exactly the same thing. My though was to just restrict (in htaccess) what IPs can access the manager folder, but maybe that will render MODx not to work at all?

Why not use your domain control panel to add user validation to the folder at that level? True, it will mean logging in twice, but it will certainly restrict access. (well, I see you mention "our DMZ", so you’d have to configure this yourself in your case)

What I ended up doing for the time being was to Allow from xxx.xxx.xxx.0/xxx.xxx.xxx.0 our internal IP and a Deny from all in the .htaccess file. The problem with the DMZ is once I allow port 80 to hit the webserver for the site at the specific ip address, I’m not sure what else I can do on the firewall to prevent access to the /manager portion of the ip address.

I’m not sure I understand, why can’t you allow everyone access to the public page, but deny public access to the Manager folder?

.htaccess ^^^
ok this is a short post ...

here is the little longer one..

.htacess can help you preventing connections from ips or allow connection from only a specific ip
find out howto do that if u need it google dude.. google

I think he know that he can use htaccess, but I also think he might not know that he can protect the manager folder alone by preventing access based on ip for just that folder!

But I’m not sure thats the case...

I actually used .htaccess, based on Uncle69’s suggestion to prevent access based on IP, I was hoping to stop access and a lower level though.

:I’m not sure I understand, why can’t you allow everyone access to the public page, but deny public access to the Manager folder?:

If you are referring to the DMZ/firewall portion, as far as I know on firewalls they restrict access based on IPs and ports they could care less about http://xxx.xxx.xxx.xxx/manager. In other words it would not know what to do with the /manager folder. I was hoping that the manager portion could run only in https which would make it a different port or something similar so I could block access at the hardware firewall.

Aha! Now I understand!

There are as I understand ways of doing what you want, bye refusing access to /manager in the firewall... I’ll have to ask a friend to be sure. Does your firewall have "deep inspection"?