Securing my website admin area

Question

So I'm building a GUI admin area for my site. I will be the only one to login and it will just show a clean (printable) layout of info from my db.

Here's what I'm doing for security. Let me know if you think this is good and how I can improve.

1. headers on all pages check for admin == true or die/redirect
2. since i have a dedicated ip at home and i will only login from home. I made all pages including the login form page check for my IP $_SERVER['REMOTE_ADDR']; != header redirect
3. My login script is in dir set 700 in folder permissions.
4. my login and pw contain 10 total combo of letters, numbers and special chars. PW is stored as SHA2 HASH
5. my login script checks for regex prior to sql and my credentials are stored in a separate admin table
6. The entire site is on SSL.

So is this secure? Can I do more? Is this overkill? Please share your opinions and suggestions (especially regarding my IP check. Can that be circumvented?)

Used to escape bad data - in conjunction with regex on every field

function escape_data ($data) {
    if (function_exists(‘mysql_real_escape_string’)) {
        global $dbc;

        $data = mysql_real_escape_string (trim($data), $dbc);
        $data = strip_tags($data);
} else {
        $data = mysql_escape_string (trim($data));
        $data = strip_tags($data);
        }
        return $data;

    }

Answer 1

NOTHING is overkill for an admin page. You want as much security as you possibly can.

As for your methods, most of them are fairly good, but some suggestions:

• Setting chmod to 700 won't prevent others from at least accessing the admin page (I'm assuming that's what you were using it for), because it's the web server that's accessing the files, regardless of who's making the HTTP request.
• Rather than checking $_SERVER['REMOTE_ADDR'], it's probably more secure (and easier) to just create a unique user SSL certificate and only allow the computer with that user certificate (i.e. yours) to access the site. This can be done in your Apache setup (if you managed to set up SSL, you can go back in and set up user certification on your SSL), solves the chmod problem, and prevents people from spoofing your IP to go into your admin page.
• If you don't need to SSH into your home computer, disable the SSH daemon. This will (hopefully) prevent others from targeting your computer to go after your server.

These are the first things I can think of. I'll add more as they come to me.

EDIT: Right, logging! Log everything that happens on your admin page. EVERYTHING. For the SSL, for the requests, for the database access, for everything. Then get a log-watching program (e.g.: logwatch) to watch it for suspicious activity.

Answer 2

• Have you also set the secure, domain and http only flag on your cookies?

my login script checks for regex prior to sql and my credentials are stored in a separate admin table

• This sounds like you are doing something wrong. Aren't you using prepared statements?
• Are you using CSRF protection?
• Are you preventing XSS attacks?
• Do you have a way to prevent brute forcing? Both on your site as on your server?
• Do you hash the password in the database? What algo do you use for this?
• Have you installed intrusion detection on your server?

And please, don't use mysql_* functions for new code. They are no longer maintained and the community has begun the deprecation process. See the red box? Instead you should learn about prepared statements and use either PDO or MySQLi. If you can't decide, this article will help to choose. If you care to learn, here is a good PDO tutorial.

P.S. as far as I know the $_SERVER['REMOTE_ADDR'] variable would be pretty safe to use, because the only way I see that being exploitable is by an attacker proxying through your machine or spoofing the ip. And (correct me when wrong) both are pretty hard to do.

P.S. 2:

Is see you are using global in your code, also please stop using that :-) For more information about this watch this talk about dependency injection and SOLID programming in general. Nothing to do with security, but simply best practices for programming.

Answer 3

Make sure you uses prepared statements for SQL, use brute-forcing protection (in cases someone gets a proxy on your PC) and do not use SHA2. SHA2 is a terrible, useless method for hashing passwords. Look into the crypt function or use pkbdf, or at the very least; a primitive sha512. (see the "hash" function)