Email notification if someone attempts to access your Admin CP
 

This is my version of the hack that Firefly released for VB2.

VB3's standard log of failed admincp login attempts is a nice feature.. but since you get no instant notification, by the time you check the log it could be too late. Also, the log doesn't show which passwords the potential intruder is trying... If someone is close to guessing my password I wanna know about it!

What does it do? With this hack, when someone tries to login to your admincp or modcp you'll get an email that contains the username they tried, the password they tried, their ip address, hostname, # of strikes, referer, script, and the date & time of the attempt.

It will look something like this:

If the person who is attempting to access your CP happens to be registered & logged in, this line will also be included in the email:
(Thanks to AlexanderT for the idea for this addon.)


Update (1-4-05): A couple of users have expressed concern about this mod sending a plaintext password over http for all logins. This update (v1.1) addresses that concern by only sending the password for cplogins. To update just re-do the first step in the instructions for your vbulletin version (the first edit to adminfunctions.php). Or if you'd prefer that the attempted password not be sent at all simply skip the edits to adminfunctions.php.

If you don't recieve an email when testing, make sure you have the webmaster email set in the admincp (vBulletin Options + Site Name / URL / Contact Details). Also, sometimes it takes a while for the email to arrive. So give it plenty of time before screaming "it doesn't work".. ;)

Still not working? Read this!

Credits: Thanks to the original creator of this hack (Chen) for the idea, and thanks to Boofo for helping me test it. :)

Installed and working like a champ! Good one, buddy! ;)

*Clicked Install*

I will have to use this one , /me kicks install

Nice hack. It could be extended by adding the username of the user (in case he was already logged in to the forum before) who tries to login.

**Clicks Install**

Excellent hack, EvilLS1

Kevin

yes thats a great idea :) i will be installing this :)

great idea, i'll use this (clicks install)

cool hack will be installing this one :)

[high]* Beermonster clicks install[/high]

Working fine on 3.0.1. Thanks!

Nice job. *clicks Install*

Nice hack cheers :)

Nice! Thanks, will be installing this one shortly!

ok.. of course i have to be the idiot that can't get this to work :ermm:

I made the changes exactly as said in the text file. I then attempted to login 2 times with wrong password..

I have waited 10- 15 minutes for the e-mail to showup.. Is this long enough.. or should i wait longer?

With the changes in place.. I am not getting any error messages or anything..

Thanks
Dave

Thats a great idea!

For those who have already installed and want to add this feature..

In login.php find:
Below it add:
Then find this code (2 places):
Replace both instances of the code above with this:
I updated the instructions to include this. Thanks to AlexanderT for the idea. :)

Thank you... works like a charm :)

Hmm.. What version of vb are you using? Heres a few things to try:

Make sure you have the webmasters email set in your admincp (under options).

Make sure you added the last bit of code in the instructions under both places.

Try re-applying all of the code changes in login.php.

Make sure your vbulletin mail system is working (run the test in the admin cp).

Keep in mind, you only get an email when someone tries to login to your admincp or modcp... This has no effect on any of the regular login forms.

How do you install hacks?

Fantastic idea!! thx

[quoye]Hmm.. What version of vb are you using? Heres a few things to try:

Make sure you have the webmasters email set in your admincp (under options).

Make sure you added the last bit of code in the instructions under both places.

Try re-applying all of the code changes in login.php.

Make sure your vbulletin mail system is working (run the test in the admin cp).

Keep in mind, you only get an email when someone tries to login to your admincp or modcp... This has no effect on any of the regular login forms.[/quote]

see i told you i was an idiot.. i never set the webmasters e-mail address in the control panel. I thought it was referring to the config.php one..

AWESOME!! Love .. thanks!

Dave

How to Install vBulletin Hacks - Guide for Newbies ;)

I'm glad the username thing has been added. It was on the vB2 version.

Great, now it shows the registered & logged in part it realy makes it complete :)

Fantastic hack and one that should be a standard vb feature, it adds abit of security to things :) Always a good idea though is to keep changing your password.

[high]* SnowBot clicks install. I love the way its done, so easy also.
[/high]

IP + Host removed.

I'm having a curious problem trying to get this to work in vB 3.01.


I first tried this on my Test Board - and everything worked fine. I tweaked the email message for spacing - but ultimately, it worked as I wanted it to.

Then I applied the hack to my primary vB site. Everything should be exactly the same. However, I'm having two oddities:


1. The Attempted Password is not shown. The field name shows - but no password is listed.

2. It's not Identifying vB Users at all. This field just doesn't even show up - exactly as if it couldn't tell that anyone was logged in. And yes, I made sure that I was logged in at the time - so it should have listed me.


Any ideas?

Update - after completely shutting down my browser and going back in - everything works now.

Strange, yes? Perhaps it had something to do with the cookies from the two vB boards (although they did have different prefixes).


As a seperate question, though - since this hack does something extra with the entered password before submitting it through the MD5 Hash - is there any additional security risk? Do normal or AdminCP logins end up with a cleartext copy of the password floating around anywhere?

*install* ;)

Glad you got it working. To answer your question: No, the only place the attempted password gets passed to is the webmaster's email, and even then only if its incorrect. This has no effect on regular logins. :)

great hack. *click Install*

My board is 3.0.1 but not working....Everything is OK,webmaster mail is OK but not working...

Anybody send me 2 modified files ?

Thanks

In your admin cp under Import & Maintenance click "Diagnostics". Do the email test to verify that your vbmail() function is working. Test it with your webmaster email address.

If it works, make sure you added the last bit of code in the instructions in two places.

If you still don't recieve the failed login email try re-applying all changes to login.php.

I've tried this and I don't get any mail either.
Could this be conflicting with another hack or something?

Did you recieve an email when you ran the email test under diagnostics? If so, and you added the code in both places in login.php I can't think of any reason why it wouldn't work for you.

I got an email when I ran the email test under diagnostics and I've checked the login.php and found the code added properly.

I'm stumped then. This hack uses the same vbmail() function used in all the other features, so it should work. I know this is a long shot, but try closing and re-opening your browser, then go back to your admincp login page and hit your refresh button.. Then try logging in again with an incorrect username or password. If it still doesn't work then I have no idea.

I don't get any email either. EvilLS, are you 100% positive that you are using the proper parameters for vbmail()?

Yep, because its working fine for me and about 40 other people who have already installed it. I just re-applied the hack again to a fresh login.php from vbulletin 3.0.1 and it worked perfectly. Very strange that its not working for only a few people. Has to be either a vb setting or something blocking it in the email software itself.

Are you by chance using any kind of spam guard for your emails? If so, maybe a combination of words in the warning email is triggering it? Thats all I can think of.

If for some reason you don't get a warning email when testing this hack please carefully read through the checklist below..

1) Log into your Admin CP and click "vbulletin options". From the list click on "Site Name / URL / Contact Details".
Scroll down to where it says "Webmaster's Email" (not Contact Us Link). Make sure that you have entered a valid email address there.

2) In your Admin CP under "Import & Maintenance" click Diagnostics.
In the email testing area enter the same email address that you have as your webmaster's email. Run the email test to verify that your vbulletin email is working properly. If it is, you should recieve an email after running the test.

3) If you're using vB 3.0.1 or earlier make sure that you added the last bit of code from the instructions in two seperate places. Open your edited login.php file and search for this:
Once you've found the first instance of that code, search for the same code again. You should find it twice.

4) This hack has been tested on vBulletin 3.0.1 - 3.0.5. If you're using a different version, open your register.php file and search for "vbmail" (without the quotes).. This is to make sure that the vbmail() function has the same name in your version.

5) Re-apply the file edits to login.php making sure that you follow the instructions carefully.

6) If you're using any kind of spam guard for your emails that blocks junk mail, turn it off (temporarily).

7) Now lets test it again. Close your browser and re-open it again. Go to your forum and click "logout". While still logged out go to yoursite.com/forums/admincp/ and then hit the "refresh" button on your browser. Type in an incorrect password and hit submit.
Now lets test it again while you are logged into the forum but not the admincp. Close your browser & reopen it again. Go to your forums and login with the correct info. Then go back to /forums/admincp/ and your username should already be listed. Type in an incorrect password and hit submit.

Wait 15-25 minutes before checking your email this time (sometimes it takes a while for the mail to be delivered).

Keep in mind, you only get an email when someone tries to login to your admincp or modcp... This has no effect on any of the regular login forms.

If you've carefully checked everything in the list above and it still doesn't work for you then it could be conflicting with another hack that you've installed. Other than that, I have no idea.

Actually, what causes it to not be delivered immediately is that when the vbmail function is called - it adds the email to the Queue, rather than sending it out immediately. The queue is triggered by activity on the board (clicking links/buttons/etc...).

So, if you do the test-incorrect-login, and then immediately stop and wait - if there's no one on your board, you're not going to get any email until someone does something on your board. All you have to do is just click on something - anything - and the queue will be processed.


Of course, this assumes that the rest of the checklist items are set correctly - but I thought I might shed some insight as to why it sometimes seems to take forever for someone to get the email. :)

Hmm.. I wasn't sure if the mail queue effected emails to the webmaster (doesn't seem to on my board). Maybe I should add that one to the checklist. :)