Separate Admin Access Path (for better compatibility and stronger security)

webdig

I've been following some excellent security practices from the CPfence community, especially this tutorial:
https://community.cpfence.app/d/9-zero-trust-access-to-cpfence-webui-using-cloudflare-tunnel-and-otp

Inspired by that, I wanted to discuss Enhance's admin access mechanism. I know Enhance already has a "Restrict admin access" feature — but as pointed out in this post (https://community.enhance.com/d/1369-restrict-admin-access-not-working-for-me/), it only works with Apache and NGINX. Unfortunately, this leaves LiteSpeed and OpenLiteSpeed users without a viable way to restrict access to the admin interface.

Wouldn't it make sense to consider an alternative approach that works across all web servers?
For example, allowing administrators to log in through a separate path such as /iamtheboss or /theownerisback, or even via a dedicated subdomain, would make it much easier to secure access using tools like Cloudflare Tunnel + Zero Trust + OTP, while still allowing clients to log in through the normal public URL.

This wouldn’t just improve security — it would also solve the current compatibility gap and offer more flexibility to hosting providers using Enhance.

Just a suggestion, as I believe security is a core pillar of any multi-tenant platform — and Enhance has the potential to lead by example here.

xyzulu

webdig it would also solve the current compatibility gap and offer more flexibility to hosting providers using Enhance.

I am a native English speaker, but I don't understand what you mean here. Could you explain another way please?

webdig this leaves LiteSpeed and OpenLiteSpeed users without a viable way to restrict access to the admin interface

Why would you want to run either of these on your control panel? I know you can.. but isn't the easiest and more logical to use apache or nginx (it seems that is how Enhance was designed.. to run a separate control panel server).

Kosta

ronald

This can easily be solved if OLS had persistent configs. A deny/allow rule can be added to the server or virtual host. This functionality is already brilliant in OLS running natively.

Until then the only logical solution, and should work well for those who separate their CP server from client/application servers, is to run Apache (or NGINX) on the CP server.

Nickske00

-1

slimx

-1 I feel like this is such an over-engineered solution.