Administrative and Maintenance Tools - [DBTech] vBSecurity v2 (vB4)

vBSecurity: What is it?
vBSecurity keeps a watchful eye over your forum even when you are not there, and has the capability to alert you of any suspicious activity.

Uses

vBSecurity is the ideal product for forums that are concerned about security, or wish to be alerted when something suspicious happens.
It keeps a watchful eye on your configuration file, ensuring that it does not get modified by mods or plugins.
Another important feature is the ability to add a secondary login, unique to each administrator, that is required before accessing the AdminCP. Ideal for forums where multiple administrators may share login information, or where administrators may log in from public computers.
Add in quick settings for the most vital vBulletin Options and Usergroup password settings, vBSecurity can easily be called one of the most comprehensive security suites for your vBulletin forum.

-------------------------------------------------------------------------------------------

If you like this mod please hit the button to the right ---->

Please remember to click the, button to the right if you installed the mod ---->

What does 'Marking As Installed' do ?

* It helps you to stay on top of updates - members who have installed modifications will be notified by us whenever new updates are available.

* For security issues - vbulletin.org will contact all members who have installed a modification whenever a security issue is brought to their attention.

* Marking a modification as installed also helps us know how many people are using our work, giving us extra incentive to provide more features and new modifications.

We appreciate the support!
-------------------------------------------------------------------------------------------

Priority support & Product Demos available at: http://www.dragonbyte-tech.com

-------------------------------------------------------------------------------------------

Translations available @ our forum
Support for translations handled by the translator in its respective threads only.

-------------------------------------------------------------------------------------------

Major Features
Administrator Security: .htaccess-like logins for your administrators means that even if they use the same password on multiple sites, malicious users still need a fresh, unique password to log in.

Security Watchers: Keep an eye on the most important aspects of vBulletin: config.php tampering, AdminCP / User Account access attempts, vBulletin Options, User Data, Usergroup Settings and Usergroup Permissions.
Detailed changelogs available for each watcher dealing with changes.
IP Ban, User Ban, Email alerts and temporary forum closure options available for each watcher individually.

Lite
* Searchable list of all AdminCP access attempts
* Searchable list of all failed login attempts
* Searchable list of administrator changes for areas governed by the Security Watchers
* vBOption: IP Address whitelist for AdminCP access
* vBOption: Separate "Closed Reason" for closures that happened due to potential security breaches
* Quick setting page for the most important vBulletin Options security settings
* Quick setting page for the most important Usergroup security settings
* Security Watchers: General - config.php Variable Tampering, AdminCP Access Attempts
* Security Watchers: Logins - Failed Logons, Failed Mass Logons
* Security Watchers: vBOptions - vBulletin Active, Reason For Turning vBulletin Off, Banned Email Addresses, Banned IP Addresses, Use Login "Strikes" System, Whitelisted IP Addresses, Whitelisted IP Addresses - Exclude Super Administrators
* Security Watchers: User Data - User Name, Password, Email, Primary Usergroup, Additional Usergroups, Reputation Level, Warnings, Infractions, Infraction Points, Receive Admin Emails
* Security Watcher Actions: 2 thresholds with individual configuration options, IP Ban / User Ban / Email Webmaster / Close Forum options available for each Watcher option listed above. Some watcher options may not have all actions.

Pro
* Optional .htaccess-like login on a per-administrator basis
* Settings Snapshots - take a "snapshot" of how the vBulletin Options look at the time, instant restore by clicking Load on a previous snapshot
* Security Watchers: Usergroup - Password Expiry, Password History, every usergroup permission group, every "value" permission
* IP Guard: Administrator IP Address authorisation scheme (similar to Steam Guard) - Require email verification for new IP addresses to access the AdminCP, per-administrator disable

-------------------------------------------------------------------------------------------
This mod displays a copyright notification in the footer of all pages which includes:

• 1 Link to DragonByte Technologies homepage
• 1 Link to Product Description page of this modification

[DragonByte Tech]

vBSecurity v1.1.8

New Features:

Login Strikes Viewer

• Login Strikes log entries can now be pruned
• Requires the "Can Prune Log Entries" config.php permission

Fillip

[DragonByte Tech]

vBSecurity v1.1.8 Patch Level 2

Bug Fixes:

• Turning the modification off via the "Enable Modification" vBOption meant you could no longer access the majority of vBSecurity admin controls
• Fixed an issue with the "login strikes" page that could produce a fatal error in certain scenarios

Fillip

[Dam13n]

For some reason, real users/visitors get IP banned when using this mod even though there were no signs of brute force login from them. I have cases when visitors got IP banned by trying to login to accounts that don't even exist in my forum database.

[af1 racing]

Originally Posted by DragonByte Tech

That was added as a feature, they'll receive an email to confirm their IP addresses
Fillip

What if they don't receive the email?

I have just upgraded to 1.2.1 and several users are reporting that they get locked out when updating their profile to "Enable IP Verification". As an Admin I also did not receive the verification email when accessing the adminCP for the first time after installation, but I was able to gain access with a quick query.

Is there a way to resend or view the email queue? Or authorize their IP through the adminCP?

[DragonByte Tech]

vBSecurity v1.2.1

New Features:

IP Verification: Front-End

• Users can control whether to require email confirmation of new IP addresses for front-end pages
• Toggleable via the UserCP
• Works in a similar fashion to the AdminCP and ModCP versions

IP Access Log

• Tracks all IP addresses used to access a user account
• Overrides the "Search IP Addresses" functionality in vBulletin to provide advanced functionality
• Works with all existing links to the "Search IP Addresses" functionality

IP Access Log: Search New IPs

• Searches for any new IP addresses being used to access accounts
• Displays a familiar looking list of IP addresses
• Selectable "start date" to check for new IPs

IP Access Log: Multiple Account Access IPs

• Searches for any IP addresses being used to access multiple accounts
• Displays a familiar looking list of IP addresses

Changes To Existing Features:

• Altered vBulletin & vBSecurity tables to be IPv6 compatible

Fillip

[DragonByte Tech]

vBSecurity v2.0.0

New Features:

(Pro) New Security Watcher: "Failed Logins: Non-Existent Usernames"

• Checks for logins against a single username that doesn't exist
• Lets you take separate action towards bots trying to login with stolen user credentials that don't exist on your site
• Integrates into the existing "Logins" watcher group

(Pro) New Security Watcher: "Failed Mass Logins: Non-Existent Usernames"

• Checks for logins against multiple usernames that don't exist
• Lets you take separate action towards bots trying to login with stolen user credentials that don't exist on your site
• Integrates into the existing "Logins" watcher group

(Pro) Compromised Accounts Detection

• Alerts the webmaster if someone has failed multiple logins and then successfully logs in to an account
• Lets you search the logs for the IP address in question to determine whether this is legitimate

(Pro) IP Ban Log Viewer

• Browsable and searchable log of all banned IP addresses (from the point of installing v2)
• Lets you ensure no legitimate members are banned

Multiple Watcher Actions

• Define more than 2 actions per watcher
• Prioritised in the order they are defined
• Gives you even more fine-tuned control over the actions taken against potential intruders

Log Pruning

• Old entries from the adminstrikes, loginstrikes and ipverify tables can be automatically pruned
• Settable in the vBulletin Options
• Defaults to pruning data older than 30 days

Changes To Existing Features:

Security Watcher Log

• Rewritten to improve performance
• Uses a dedicated log table instead of using the datastore

Fillip

[akz645]

Originally Posted by DragonByte Tech

Changes To Existing Features:

• Altered vBulletin & vBSecurity tables to be IPv6 compatible

https://theadminzone.com/threads/vbu...counts.136907/
1) So will this mod prevent prevent that?

----

2) Can this Mod notify mods/admins by posting in a specific forum section (via designated userID selected by the admin), when multiple accounts are being logged into by the same IP address?
3) Can this Mod notify mods/admins by posting in a specific forum section (via designated userID selected by the admin), when one account is being logged into by the multiple IP address?

4) Can this Mod notify mods/admins by posting in a specific forum section (via designated userID selected by the admin), when multiple accounts are being logged into on the same computer (cookies/cache detection)?
5) Can this Mod notify mods/admins by posting in a specific forum section (via designated userID selected by the admin), when one account is being logged into by the multiple computers (cookies/cache detection)?

[DragonByte Tech]

Originally Posted by akz645

1) So will this mod prevent prevent that?

Yes it does

Originally Posted by akz645

2) Can this Mod notify mods/admins via a specific forum section, when multiple accounts are being logged into by the same IP address?
3) Can this Mod notify mods/admins via a specific forum section, when one account is being logged into by the multiple IP address?

4) Can this Mod notify mods/admins via a specific forum section, when multiple accounts are being logged into on the same computer (cookies/cache detection)?
5) Can this Mod notify mods/admins via a specific forum section, when one account is being logged into by the multiple computers (cookies/cache detection)?

None of these things are possible at this time, this is not a "multiple account detection" mod. This mod focuses on addressing behavioural patterns that are potentially harmful to the security of your forum, whereas multiple accounts is more related to circumventing bans.

All alerts go to the Webmaster Email account as well


Fillip

[DragonByte Tech]

vBSecurity v2.1.0

New Features:

IP Verification

• IP addresses that have been verified by users or administrators will no longer be subject to IP bans
• Helps prevent false positives

Admin IP Verification: Re-Send Emails

• Administrators can request to re-send the email to verify their IP address
• Useful if the email takes a long time to arrive for whatever reason

User IP Verification: Re-Send Emails

• Users can request to re-send the email to verify their IP address
• Useful if the email takes a long time to arrive for whatever reason

Security Watcher Display

• The time period for the Security Watcher display can be configured
• Default: 7 days
• Controlled via vBulletin Options

(Pro) User IP Verification: Admin Control

• Super Administrators can disable a member?s IP verification setting via the AdminCP user management screen
• Accessed via the User Manager

(Pro) IP Address Search: Country Display

• The IP Address Search screen includes the IP address' country, if your system supports this
• Requires GeoIP2 downloaded database on your server
• Controlled via vBulletin Options

(Pro) IP Host Lookup: Country Display

• The IP Host Lookup screen includes the IP address' country, if your system supports this
• Requires GeoIP2 downloaded database on your server
• Controlled via vBulletin Options

(Pro) IP Address Search: IP Usage

• The IP Address Search displays the first and last logged date for a particular IP in the "Logged IP Addresses" list
• Only displays IP addresses since v2.0.0 was installed.

(Pro) Compromised Accounts Log

• Displays a list of accounts flagged as potentially compromised
• Quick links to users' logged IP addresses as well as displaying current IP address
• Fully searchable
• Can only be viewed by administrators with the "Can View Admin Logs" config.php permission
• Can be pruned by administrators with the "Can Prune Admin Logs" config.php permission

(Pro) Watcher log

• Displays the complete list of all Watcher log entries
• Can be filtered by individual watchers
• Fully searchable
• Can only be viewed by administrators with the "Can View Admin Logs" config.php permission
• Can be pruned by administrators with the "Can Prune Admin Logs" config.php permission

(Pro) User IP Verification log

• Displays the complete list of all user IP Verification entries
• Displays whether the IP has been verified or not
• Fully searchable
• Can only be viewed by administrators with the "Can View Admin Logs" config.php permission
• Can be pruned by administrators with the "Can Prune Admin Logs" config.php permission

(Pro) Admin IP Verification log

• Displays the complete list of all admin IP Verification entries
• Displays whether the IP has been verified or not
• Fully searchable
• Can only be viewed by administrators with the "Can View Admin Logs" config.php permission
• Can be pruned by administrators with the "Can Prune Admin Logs" config.php permission

Changes To Existing Features:

• Consolidated the code that applies watcher actions to enable easy extension in the future
• Config Tampering alerts can now be reset
• Reworded one of the new Log Prune options to clarify what exactly it?s pruning
• All log pages now require the config.php "Can View Admin Logs" setting for additional security
• "AdminCP Logins Viewer" now uses username search instead of a drop-down for improved performance
• "Admin Strikes Viewer" should now perform better as a result of removal of an unreliable feature
• "Login Strikes Viewer" now uses username search instead of a drop-down for improved performance
• "IP Ban Log Viewer" now allows you to filter by action when pruning the log

Bug Fixes:

• An issue where limiting the IP Ban Log by action would not work as intended has been corrected
• "Failed Admin Logins" have been moved to the "Logins" watcher group, as was intended
• Fixed an issue where the Config Tamper watcher log could not be reset

Fillip

[af1 racing]

Excellent! Thanks for the quick development.