Securing my own administration panel - php

Question

I need ways to securize my own php administration panel. I read here about some:
A simple authentication using apache2.conf
Using ssl to send encrypted passwords
Host the tools on a completely seperate domain
A proper robots.txt should also be used
Using chmod 777 when i want to use and do a chmod 000 when i finish
But eachone has problems.
If i want to do it with apache2.conf, i must use ssl too. Only with this is it secured?
If i upload the tools in other domain and use robots.txt to "hide" them, could someone find them?
Using chmod is like "non-professional"
What do you use to secure your administration panel?

Answer 1

But eachone has problems. If i want to do it with apache2.conf, i
must use ssl too. Only with this is it secured?
Sort of. If you don't use ssl, passwords are sent over the net unencrypted if someone is listening in on your communication, they will know the password. That being said, it is usually impossible for someone to listen to your communication with the server unless one of the participating parties has already been compromised or you are communicating through an unsafe medium like unencrypted public wlan.
If i upload the tools in other domain and use robots.txt to "hide"
them, could someone find them?
Yes, if they guess the URL. robots.txt just hides you from search engines, but it does not work for protecting your admin panel from unwanted access.
Using chmod is like "non-professional"
And unsafe. It means that whenever you are working on the admin panel, everyone else also can. Don't do this.
What do you use?
Access control with Apache (either through the global config or an .htaccess file) with SSL. It may be a bit painful to set up at first, but for the given problem, it really is the only choice that makes any sense.

Answer 2

What you could do is use a php class that requires you to log in or sign up to your Website. You can find plenty from a quick Google.
Then, you should make an API on your Website that only sends data back if you're authenticated. Here's an example that would read data from a MySQL database:
<?php
require_once $_SERVER["DOCUMENT_ROOT"] . "/includes/accounts.class.php"; //Change this to the path to your authentication script
header("Content-Type: application/json"); //Important if you're using json
$account = new Accounts(); //A fictional Accounts class is opened
$json = array();
if (!$account->authenticated or $account->rights != "administrator") { //Ask the class if the user is not an admin
$json = array(
"error" => "Not an administrator"
);
} else {
$query = mysqli_query($link, "SELECT * FROM example"); //Assuming you use mysqli and there's a table called example
if (!$query or mysqli_num_rows($query) < 1) {
$json = array(
"error" => "Query returned no results"
);
} else {
while ($row = mysqli_fetch_array($query)) { //Read the data from the table
$json[] = $row;
}
}
}
echo json_encode($json); //Send the data as a json string
Remember that the above code is only an example of how you would do this sort of script. You'll need to modify it to work with the class and database you are using.
Now you can make your own program for your own internal use that logs in to and queries data from your API. This could be a Website running on an internal server, a Windows program or a smartphone app. All it would need to do is fill in the form on the log in Webpage, then send a HTTP request to the script above and decode the json result.