Troubleshooting: The /Admin/ Endpoint Is Visible by Default

Version Affected: All
 
 

Overview

The /Admin/ endpoint on a SecureAuth appliance is visible by default. Browsing to it exposes a realms.json file, but its contents are only template data, not real configuration from the appliance.

Cause

This is expected default configuration. The /Admin/ endpoint and its realms.json file only ever contain template data; they do not expose any actual data from a configured realm.

Resolution:

This endpoint can be blocked using an Internet Information Services (IIS) URL Rewrite rule that restricts access by IP address. This is the easiest option.

1. Open IIS Manager.
2. Navigate through Sites > Default Web Site to the Admin site.
3. Double-click URL Rewrite.
4. Click Add Rule(s)...
5. Select Request blocking and click OK.
6. Set Block access based on to IP Address.
7. Set Block request that to Does Not Match the Pattern.
8. Set Pattern (IP Address) to 127.0.0.1.
9. Click OK.

Alternatively, you can use an IIS redirect rule to send /Admin traffic to a different realm instead of blocking it outright.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.