Kayako Login Security

[GoneShootin]

I've been thinking about the logins security and ways of locking down access. One thing that came to mind was the implement IP based access, for example in the index.php files for /staff and /admin I added to the top:

PHP Code:

if($_SERVER[REMOTE_ADDR]!="--my trusted ip---")
  die("Error! You are not coming from a trusted location"); 


Such that if someone is not coming from the IP address then they cannot access the index login screens.

While the IP address can spoofed is there something I need to be aware of with this setup?

[craigbrass]

Limit Windows Application Login to Specific IPs could be used fine with the same result for /staff and /admin login pages.

[John Haugeland]

It really is best to do things like that in .htaccess, rather than in PHP, due to the need to replace them during upgrade.