I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat 6 (using Java/JSP) on AWS cloud.
Now, the server uses logins/passwords to identify users in both cases — in case of the mobile app, the login/password is in the app and shared across all instances of the app. If anyone starts looking at the network traffic of the client, he will see URL, login and password, will go to the URL and will be able to log into the CMS (or at least launch a brute-force attack against the login service).
What is the best way to secure the CMS? My ideas are roughly:
- Move the CMS to a different server instance and a different domain. It will still share the underlying DB with the Web Service.
- Obscure the login point of the server. Instead of basically redirecting all invalid URLs to the login page, send them strictly to 404 and rename login to something random.
- Make sure the mobile app uses logins/passwords that don't work in CMS (by implementing different roles for CMS editor / app user) and harden the login against (brute force etc) attacks.