EPC Log-in Detector

[blogtorank]

EPC Log-in Detector


Description:

ALL Admins will be notified of who tried to attempt successfully and not successfully to login to your forums and admincp. As this will notify ALL the admins of the offending or not offending person's username used and their IP.

Simple modification and thought we would share this file edit with the rest if they wanted to use this. Here is an example e-mail with the following:

from Testing
to
date Sep 5, 2007 9:43 PM
subject Bad login
mailed-by
'theirip' was found trying to login to the account admin. Please investigate this as soon as you canEdits to be made:

***Warning: Before you make edits, do a back of the following files before commencing:


/includes/functions_login.php
/login.php
go to /includes/functions_login.php:

Find:

if (($strikes_user['strikes'] % 5 == 0) AND $user = $vbulletin->db->query_first("SELECT userid, username, email, languageid FROM " . TABLE_PREFIX . "user WHERE username = '" . $vbulletin->db->escape_string($username) . "' AND usergroupid <> 3"))
{ // they've got it wrong 5 times for this user lets email them
$ip = IPADDRESS;
eval(fetch_email_phrases('accountlocked', $user['languageid']));
vbmail($user['email'], $subject, $message, true);

Add Under:

///code added by EPC Login Detector
$ip = IPADDRESS;
$subject="Bad login - 5 tries";
$message="'$ip' was found trying to login to the account ".$vbulletin->GPC['vb_login_username']." and was blocked. Please investigate this as soon as you can.";
$admin = $vbulletin->db->query_read_slave("SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000");
while ($item = $vbulletin->db->fetch_array($admin)) {
vbmail($item['email'], $subject, $message, true);
}
//code end by EPC Login Detector

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++

go to /login.php

Find:

if (!verify_authentication($vbulletin->GPC['vb_login_username'], $vbulletin->GPC['vb_login_password'], $vbulletin->GPC['vb_login_md5password'], $vbulletin->GPC['vb_login_md5password_utf'], $vbulletin->GPC['cookieuser'], true))
{

Add under:

///code added by EPC Login Detector
$ip = IPADDRESS;
$subject="Bad login";
$message="'$ip' was found trying to login to the account ".$vbulletin->GPC['vb_login_username'].". Please investigate this as soon as you can.";
$admin = $vbulletin->db->query_read_slave("SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000");
while ($item = $db->fetch_array($admin)) {
vbmail($item['email'], $subject, $message, true);
}
//code end by EPC Login Detector

Find:

// log this error if attempting to access the control panel
require_once(DIR . '/includes/functions_log_error.php');
log_vbulletin_error($vbulletin->GPC['vb_login_username'], 'security');

Add under:

///code added by EPC Login Detector
$ip = IPADDRESS;
$subject="ADMIN AREA: Bad login";
$message="'$ip' was found trying to login to the account ".$vbulletin->GPC['vb_login_username'].". Please investigate this as soon as you can.";
$admin = $vbulletin->db->query_read_slave("SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000");
while ($item = $db->fetch_array($admin)) {
vbmail($item['email'], $subject, $message, true);
}
//code end EPC Login Detector

Find:

$vbulletin->userinfo = $original_userinfo;

if ($vbulletin->options['usestrikesystem'])
{
eval(standard_error(fetch_error('badlogin_strikes' , $vbulletin->options['bburl'], $vbulletin->session->vars['sessionurl'], $strikes)));
}
else
{
eval(standard_error(fetch_error('badlogin', $vbulletin->options['bburl'], $vbulletin->session->vars['sessionurl'])));
}

}

Add under:

///code added by EPC Login Detector
$ip = IPADDRESS;
$subject="Successeful login";
$message="'$ip' logged into the account ".$vbulletin->GPC['vb_login_username'].". Please investigate this as soon as you can.";
$admin = $vbulletin->db->query_read_slave("SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000");
while ($item = $db->fetch_array($admin)) {
vbmail($item['email'], $subject, $message, true);
}
//code end EPC Login Detector

That's it!

Summary:

This is only for the ones that want to be notified when there is a unsuccessful login to their forums and to notify the admins. Just a thing we "feel" that vBulletin should implement within their core due to security reasons for forums. It would benefit on seeing who and what is happening for a forums when there is an attempted breach of security of the forums. So whomever had more ideas on how to expand this feel free to update here with ideas or share code of making this better!

[WarLion]

this is asome i will try rigth now
looks really usefull thanks

[blogtorank]

Works nice, because if you value your community and the security of it surely this will come in handy! Takes a total of 2 mins to mod 2 files and you are done! Thanks for the compliments.

[WarLion]

your welcome i already install but i have one little question how i can test it it works if i try with a wrong pass for my admin user?
or how i can test it, i try by myself but i havent recive any email.

will be great if you make it to send a pm also.

[blogtorank]

Well it should send out using your mail server automatically alerting the admins...

Simply type in anything like:

admin ///// sdkfjsadlfksadlfhsadf

Then you'll get a e-mail sent to your admins stating Bad Login ;)

[WarLion]

ok i try enter 5 times wrong pass to close the acount and i only recive the email from vbulletin
after i try one more time , and error apear

Fatal error: Call to a member function on a non-object in /home/warlion/public_html/foro/includes/functions_login.php on line 86
that line for me is this one
while ($item = $db->fetch_array($admin)) {

[blogtorank]

Checking into that for you now.

[blogtorank]

Replace your code on that file with the following:

///code added by EPC Login Detector
$ip = IPADDRESS;
$subject="Bad login - 5 tries";
$message="'$ip' was found trying to login to the account ".$vbulletin->GPC['vb_login_username']." and was blocked. Please investigate this as soon as you can.";
$admin = $vbulletin->db->query_read_slave("SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000");
while ($item = $vbulletin->db->fetch_array($admin)) {
vbmail($item['email'], $subject, $message, true);
}
//code end by EPC Login Detector

Updated the hack's How To!

[jluerken]

Great, thanks. This should become vB standard

[Cybertims]

One thing you should mention though, it seems this will only send an email if your user tite is Administrator, coud you not have it send the email to all in the admin usergroup?

What if the admin has changed his usertitle?

Cheers

[valdet]

One thing you should mention though, it seems this will only send an email if your user tite is Administrator, coud you not have it send the email to all in the admin usergroup?

What if the admin has changed his usertitle?

Cheers

In this case I use the Admin usergroupid

Find:
>query_read_slave("SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000");

Replace with:
>query_read_slave("SELECT * FROM `user` WHERE `usergroupid` = '6' limit 0,3000");


But wait.. wanna limit only to your Admin account and not to some other admins..
>query_read_slave("SELECT * FROM `user` WHERE `usergroupid` = '6' AND `username` = 'yourADMINusername' limit 0,3000");

Have fun...

[WarLion]

In this case I use the Admin usergroupid

Find:


Replace with:



But wait.. wanna limit only to your Admin account and not to some other admins..


Have fun...

ooooooooo meaby this is my problem cuz i have custom user title i will try one more time thaanks for this

edit:
:D:D:D:D:D:D that was my problem now i recive all the types of message i guess you need to change your code with usergroupid insted administratos and will work for all kind thank you so much

[Dr.NoTime]

Hi,

Nice mod, thanks.

Question. Can I modify it to only notify if someone logs in unsuccessfully?

[apiasto]

very nice idea, will it work on 3.6.7

[Fraxter]

I become an error if i want log in in my acp:

Datenbankfehler in vBulletin 3.6.8:

Invalid SQL:
SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000;

MySQL-Fehler : Table 'dax0801.user' doesn't exist
Fehler-Nr. : 1146
Datum : Friday, September 7th 2007 @ 05:05:57 PM
Skript : http://xxx/login.php
Referrer : http://xxx/admincp/index.php
IP-Adresse : xxx
Benutzername : xxx
Klassenname : vB_Database

Can anyone help me with my problem?

[C_P]

I selected Installed only after adding valdet's code suggestion that works great! SMF has a similar mod built in to their admin CP which is a great feature.
This is nice as well.

Find:

Quote:
>query_read_slave("SELECT * FROM `user` WHERE `usertitle` = 'Administrator' limit 0,3000");
Replace with:

Quote:
>query_read_slave("SELECT * FROM `user` WHERE `usergroupid` = '6' limit 0,3000");

Also, SERIOUSLY consider this addition unless your other admins do not care to get all of these emails.
But wait.. wanna limit only to your Admin account and not to some other admins..
Quote:
>query_read_slave("SELECT * FROM `user` WHERE `usergroupid` = '6' AND `username` = 'yourADMINusername' limit 0,3000");

[valdet]

I become an error if i want log in in my acp:



Can anyone help me with my problem?

That is because your usergroup title for Administrator is probably different. Check the workaround couple of posts above and that should work..

All credits go out to blogtorank for this great idea, and you are free to add my suggestion to your original hack.

Thanks, Val.

[yoyoyoyo]

Typo: Successeful login
should be: Successful login

Also, is there anyway to stop it from sending e-mail to me when I login from a certain IP address? I hate getting e-mails each time I login, and would only like to recieve them if someone rather than myself logs in

[Iskib]

--------------------------------------------------------------------------------

I purchased the full version of another one of this guys products. It has been 5 days and still not able to download it. They have asked for information which I have sent and still the file is not there to download.

I have sent 3 support tickets with no response.

************WARNING**************

STAY AWAY

[SuperTaz]

Can you make it so that regular users can not log into the ModCP as well as the AdminCP? If someone does, that does not have the permissions for either one, a pm or thread will be created to notify all admins and moderators.

[Mrdby]

update?

[therogueforums]

Hey...

I installed this, and now I, nor any other admin, can login to the ACP- whatsoever. We're locked out, even though we are inputting the correct passwords. What gives man?!@?

[therogueforums]

I'd like to try this hack again, but am extremely weary of the last go round, and STILL no response...