Originally Posted by Wicked One 612 (Post 1755649)

Hey, I'm having a problem with vBFirewall.

If it's enabled and I go to Usergroups > Administrator Permissions > View Control Panel Log it gives me this error "1||1235699733||||||||Error Opening Logfile." (Semi-random numbers each time). If I disable vBFirewall this doesn't happen. It happens in other random places too, same error. It also emails me saying that vBFirewall has prevented an attack whenever I view the page.

Any ideas?

Originally Posted by gmerin (Post 1755701)

I had the same thing. the logfile did not have the correct permissions set. 0666 is sufficient to make the file writable.

Originally Posted by gmerin (Post 1755701)

I had the same thing. the logfile did not have the correct permissions set. 0666 is sufficient to make the file writable.

Originally Posted by desirulez (Post 1751900)

1||1235352914||||||||
1||1235353109||||||||
1||1235353127||||||||


what is this means

Originally Posted by Biker_GA (Post 1801823)

Are you sure?

The problem I see with this plugin is it does NOT differentiate between valid requests from the membership and real attempts to hijack the board. It reminds me a little bit of the early versions of Zone Alarm that popped an "Oh My Lord" message every time a packet hit the PC. The uninformed would then panic and scream bloody blue murder that someone was trying to attack their PC, when in fact, all it that happened was a query packet was received from the DNS.

Until this plugin can tell what's valid and what isn't, people should not put much faith in what it reports as an attack.

Originally Posted by MrEyes (Post 1670137)

Good mod, fantastic idea, however the subscription issue is something of a show stopper. So I decided to look into it.

The reason the "firewall" kicks in on the subscription page is that one of the security rules is 'script', and quiet rightly so. However due to the checking method used, the firewall kicks in when it sees:

do=viewsubscription

Notice the bold/underlined part

The good news is that this can be resolved, but it is a hack to the mod. The following instructions explain what needs to be done, if you want to implement it then I strongly recommend first testing it on an test server. Hopefully this will help the mod dev makes this mod one of the best available here:

Right, you need to goto:

ACP -> Plugins & Products -> Plugin Manager

Once there look for the entries for "Product : vBFirewall", this should only have one plugin called 'vBFirewall' which uses the 'init_startup' plugin. Click edit

Copy all the text in 'Plugin PHP Code' into notepad.

Now follow these steps:

• Find the line that reads:
  
  
  Code:

  ---

  'st=-', 'cat%20', 'include', '_path=');

  ---

• On a new line immediately after this paste in:
  
  
  Code:

  ---

  $securityexclusions = array(
        'do=viewsubscription'
);

  ---

• Find the line that reads:
  
  
  Code:

  ---

  $cracker = strtolower($cracker);

  ---

• On a new line immediately after this paste in:
  
  
  Code:

  ---

  $cracker= str_replace($securityexclusions, '', $cracker);

  ---

Once done, copy all the edited text in notepad back into the 'Plugin PHP Code' in ACP, then click save

What this is actually doing is creating an extendible security rule exclusion list, so if any other VB queries string invoke the vbFirewall you can add another exclusion.

IMPORTANT : I have only run this on a basic test server I have, do not try this unless you are absolutely comfortable with plugins/php etc.

A here are some suggestions for the next version:

• Rather than add the logs to a flat file on the server store this in the DB and then create an ACP page to view/search/manage logs
• Add option to send a PM or Email or both
• If a specific IP invokes the firewall more than X times in Y seconds/minutes auto place this IP on the vBulletin ban list.
• If a specific IP can be associated to an actual forum user account auto ban that user.

One other teeny weeny little thing, you need to mention that this is based on the GPL licensed code found here : http://www.cback.de/cback_software/standalonect.php ;)

EDIT: Later in this thread I have posted an additional fix for vbAnonymizer users