Re: Security concerns about publically exposing admin tool

2008-04-13 Thread Justin Lilly
It isn't out of date per se. It is, however, going to be revamped when we have a stable replacement. You can find more information on the wiki at http://code.djangoproject.com/wiki/NewformsAdminBranch -justin On Mon, Apr 14, 2008 at 12:32 AM, meppum <[EMAIL PROTECTED]> wrote: > > newforms-admin?

Re: Security concerns about publically exposing admin tool

2008-04-13 Thread [EMAIL PROTECTED]
Once newforms-admin hits you will be able to change that if you want(without hacking on the django source). On Apr 13, 11:08 pm, meppum <[EMAIL PROTECTED]> wrote: > I simply meant that after a few failed password attempts the user is > not presented with a CAPTCHA or something. I'll keep all this

Re: Security concerns about publically exposing admin tool

2008-04-13 Thread Malcolm Tredinnick
On Sun, 2008-04-13 at 20:36 -0700, meppum wrote: > I noticed that most django sites including djangoproject.com and even > curse.com allow their admin sites to be accessed through the web. This > seems like a bit of a security concern as someone could create a bot > to attempt to collect password

Re: Security concerns about publically exposing admin tool

2008-04-13 Thread Jacob Kaplan-Moss
On Sun, Apr 13, 2008 at 10:36 PM, meppum <[EMAIL PROTECTED]> wrote: > Is this common practice or am I wrong about the admin sites ability to > be cracked with brute force? I was curious about this once, too, so I ran a dictionary attack bot I, erm, "obtained" against my Django admin once. It to

Re: Security concerns about publically exposing admin tool

2008-04-13 Thread [EMAIL PROTECTED]
There's no reason you have to put it at /admin/ , you could always put it somewhere else(/boogy_man/) for security through obscurity. On Apr 13, 10:36 pm, meppum <[EMAIL PROTECTED]> wrote: > I noticed that most django sites including djangoproject.com and even > curse.com allow their admin sites