Ip verify when login

[Skyline_GT]

I wonder is it possible to do this? When they login, it will verify to the ip that they used when they register? I think this is a good security feature.

[KTBleeding]

Not THAT bad of an idea, but that means they won't be able to login from a school / work / other computer.

[Tekton]

Wouldn't be too hard, but I would strongly recommend against it. (see what KTB said).

You'd have to store the IP at registration; you could make a new field for that in the user table and then just go into the (functions_register?) and add it in for the address. $_SERVER['REMOTE_ADDR'] is what you need for their IP I think.

functions_login.php is the file you will have to match their IP to the IP stored in the user field.

[Skyline_GT]

I think there should be an option when they register or they can active or deactive the option in their user cp.

Can you post a more detail instruction please?
THanks.

[Tekton]

Originally Posted by Skyline_GT

I think there should be an option when they register or they can active or deactive the option in their user cp.

Can you post a more detail instruction please?
THanks.

Well, I'm not going to go through the usercp option right now, but assuming you stored the IP address in a user table field, named "reg_ip" or something.

in includes/functions_login.php, find:

PHP Code:

if ($bbuserinfo = $DB_site->query_first("SELECT userid, usergroupid, membergroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . addslashes(htmlspecialchars_uni($username)) . "'"))
{
if ($bbuserinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $bbuserinfo['salt']), '') AND$bbuserinfo['password'] != md5($md5password . $bbuserinfo['salt']) AND $bbuserinfo['password'] != iif($md5password_utf, md5($md5password_utf . $bbuserinfo['salt']), '')
){return false;} 


and CHANGE TO:

PHP Code:

if ($bbuserinfo = $DB_site->query_first("SELECT userid, usergroupid, membergroupids, username, password, salt, rep_ip FROM " . TABLE_PREFIX . "user WHERE username = '" . addslashes(htmlspecialchars_uni($username)) . "'"))
{
if ($bbuserinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $bbuserinfo['salt']), '') AND $bbuserinfo['password'] != md5($md5password . $bbuserinfo['salt']) AND $bbuserinfo['password'] != iif($md5password_utf, md5($md5password_utf . $bbuserinfo['salt']), '')
){return false;}
if ($bbuserinfo['reg_ip]!=$_SERVER['REMOTE_ADDR']){return false;} 


I'm pretty sure that'd do the right thing. But you'd need to add a condition to check if that field was blank, etc and not run that condition to prevent lock-out. Do you know how to add the code you need to the registration php?

[Skyline_GT]

please list it ..
THanks..

BTW: is it poissble that it only applies to a certain usergroup? I think based on usergroup is better for me.

[Marco van Herwaarden]

First of all, the registration IP is already stored in the user table. That is out of the box behaviour for vB.

About checking this: very bad idea, don't do it!!!
What about people on dynamic IP's?

[Tekton]

oh, I didn't know it stored it already. One less thing to do, I guess~

[aloha]

AOL has that security feature key, could this be implemented INSTEAD of the IP verification? So that we can use this passcode key to login? That would own. :devious: I used to work for them in the customer service department and this would be how we logged in from our homes and so forth... I've never had any of my accounts compromised in any shape or form. It's now a premium feature on AOL for those that want an extra layer of security on their account.

I believe its ran by RSA Security.

[angelicGrace]

Sounds great, but you ay have members that have an isp like mine that rotates their ip addy. mine has been known to change has many as 15 times in one day. It could cause you more problems than it is worth.