A discussion on admin account security best practices has taken place. bobbysmith initially expressed concerns about potential brute force attacks on their admin account due to the visible username. They asked if enabling 2FA would prevent this and if having separate moderator and admin accounts is a best practice.
itbhanusharma reassured that most brute force attempts would result in the attacker’s IP being banned, and 2FA would provide an additional layer of security. JimPas clarified that attempting to log in as an admin would require the attacker to know the email address used during account setup. They also recommended not logging out as an administrator to avoid the need to re-enter credentials.
riking corrected JimPas, stating that admins can log in using their username and that 2FA would prevent password reuse. JimPas acknowledged the error and appreciated the correction.
bobbysmith thanked the community for their helpful responses and asked if it’s possible to require email logins instead of username logins. jomaxro emphasized the importance of enabling 2FA whenever possible, not just on Discourse.
Key takeaways include:
Enabling 2FA is a good security practice to prevent brute force attacks.
Having separate moderator and admin accounts can be beneficial, but it’s not strictly necessary.
SSH access can be used to restore access in case of a lockout.
Requiring email logins instead of username logins is not discussed as a possibility in the forum software settings.
I have searched for something like this but have not been able to find exactly what I am looking for.
I am trying to protect my admin account. My concern, which is most likely an edge case but possible nevertheless, is that someone could keep trying my admin account username (visible because I use it to post user guides etc.) and lock me out by simply trying it several times. I know this won’t lock me out permanently, but I would like to avoid this altogether.
Will enabling 2FA prevent this?
Also, as a best practice, should I have both a moderator account for myself to moderate the forum, and an admin account to do everything admin related?
I think my confusion stems from the fact that when I first set up the forum, ‘system’ was the account that did everything and when I would post messages it would come from system.
If anyone was going to try to log in as you, they would have to know the email address you used when you set up your account. IF you forgot your password, they would also have to have access to your email account to receive a password reset… if the reset is even possible.
Do you log out as administrator? If not, every time you go to your forum, your IP address and cookie are recognized and you are logged in automatically. If you do log out, that’s when you have have to log back in using your email address (used at creating your forum) and password.
From your description, you are concerned of a potential situation happening and not something that has actually happened?
Regarding having a seperate moderator and an Admin account: Unless you also make the mod account an Admin, as a moderator you will not be able to access the Admin functions. I am an Admin but don’t have a separate Mod account. I do have one Mod whom I trust that I also made an Admin… but she doesn’t mess with any Admin duties (afraid to mess up the forum? ). But should something happen to me - although I plan on living to 102 so I have 35 years to go - this Mod can take over. My other Mod is “just a Mod”.
The ‘system’ is the forum software. When you set up your forum you did set up an account for yourself, didn’t you? It seems that would be a requirement. When you post something, it should show it as being posted by you and not by the system. It seems strange that you posts would be shown as “system” and not from your username.
). But should something happen to me - although I plan on living to 102 so I have 35 years to go - this Mod can take over. My other Mod is “just a Mod”.