如果您想防止暴力破解或字典攻击，并且未经授权的用户和普通用户无法访问管理员登录页面，请按照以下步骤操作：
首先安装Django Admin Honeypot和Signal。
pip install django-admin-honeypot(inastall in settings.py)
pip install django-honeypot-signals(inastall in settings.py)
覆盖这个 .txt 文件（因为 future 标签已被弃用）：
templates/honeypot_signals/notification.txt:
{% load i18n %}
{% blocktrans with site_name=site.name %}
{% endblocktrans %}
Invalid login attempt from your duplicate ADMIN panel..
• Review entry at http://{{ site.domain }}{% url "admin:admin_honeypot_loginattempt_change" object.id %}
Username: {{ object.username }}
IP: {{ object.ip_address }}
Timestamp: {{ object.timestamp }}
django-admin-honeypot 可以制作一个虚假的管理员登录页面，而 django honeypot signal 会在有人尝试访问您的虚假管理员登录页面时向管理员发送包含凭据的电子邮件。
如何访问主要的管理员登录页面？：
pip install django-decorator-include
您的主 urls.py：
from django.contrib import admin
from django.urls import path
from django.urls.conf import include
from . import settings
from decorator_include import decorator_include
from django.contrib.auth.decorators import login_required, user_passes_test
from django.core.exceptions import PermissionDenied
from django.core.mail.message import EmailMessage
from datetime import datetime
from django.views.generic.base import RedirectView
def only_user():
def check(user):
if user.is_authenticated and user.is_superuser or user.is_staff:
return True
time = datetime.now()
message = f'----------------------------------\nName: {user.username}\nEmail: {user.email}\nTime: {time}.\n----------------------------------\n • {user.username} is not a staff user or admin.For some security reasons..Please block this user from your admin panel(Blacklist).'
email = EmailMessage(
f'Alert!! {user.username} is try to accessing your admin panel!!',
message,
settings.EMAIL_HOST_USER,
[settings.EMAIL_HOST_USER],
)
email.fail_silently = False
email.send()
raise PermissionDenied
return user_passes_test(check)
urlpatterns = [
path('', include('product.urls')),
path('admin/', include('admin_honeypot.urls',
namespace='admin_honeypot')),
path('site/admin/',RedirectView.as_view(url='/admin')),
path('user/admin/',RedirectView.as_view(url='/admin')),
path('secure/admin/',RedirectView.as_view(url='/admin')),
path('mysite/admin/',RedirectView.as_view(url='/admin')),
path('admin/secure',RedirectView.as_view(url='/admin')),
path('real/admin/',RedirectView.as_view(url='/admin')),
path('custom_url/',
decorator_include([login_required, only_user()],
admin.site.urls)),
]
对于这种方式，您无法直接访问管理员登录页面。首先需要登陆您的网站，然后才能访问您的管理员面板。
如何保护网站的登录页面免受攻击者攻击？：
- Use django defender (https://django-defender.readthedocs.io/en/latest/)
---------------------OR-------------------------
- Use google hidden(ReCaptchaV2Invisible) recaptcha field
(https://pypi.org/project/django-recaptcha/)
如果检测到任何未经授权的用户恶意活动，您可以使用这个Django包阻止他们的IP地址或用户名：
pip install django-blacklist
阅读文档：django-blacklist
•抱歉我的英语不好
