Get an e-mail if someone is trying to access your Admin CP (With IP address)

Here's my version:

In sessions.php find this code:

    if (md5($loginpassword)!=$bbuserinfo[password]) {

right below it, add this code:

			$ipaddress=iif(getenv("REMOTE_ADDR")!="",getenv("REMOTE_ADDR"),$HTTP_HOST);
			$iphostname = @gethostbyaddr($ipaddress);
			$message="Someone is trying to login using your admin account!\n\nUsername he tried to use: $loginusername\nPassword he tried to use: $loginpassword (".md5($loginpassword)." in encryption)\n\nThe IP address is: $ipaddress\nThe host is: $iphostname";
			mail($webmasteremail,"Warning: vBulletin Admin Login Tried",$message,"From: \"$bbtitle Admin CP\" <$webmasteremail>");

You will get a message:

Someone is trying to login using your admin account!

Username he tried to use: xxx
Password he tried to use: xxx (xxxxxxxxxxxxxxxxxxxx in encryption)

The IP address is: xx.xx.xx.xx

every time someone is trying to login to the admin cp with no success.

Have fun.

[Hooper]

[QUOTE]Originally posted by timmiman
i had a problem, when i use the right password, he sends the email too! what do i wrong?

[scopeman]

o.k thank for your reply, i exactly look at the code again.

sorry for my bad english, i am a german boy

[scopeman]

ok i found the error. i had the code placed befor not behind the

if (md5($loginpassword)!=$bbuserinfo[password]) {

thanks for your 1a support here

[Hooper]

[QUOTE]Originally posted by timmiman
ok i found the error. i had the code placed befor not behind the

if (md5($loginpassword)!=$bbuserinfo[password]) {

thanks for your 1a support here

[Lesane]

Does anyone know where 2 put this in sessions.php of 2.0.3 because the 2.0.3 sessions.php doesnt have this line:

PHP Code:

    if (md5($loginpassword)!=$bbuserinfo[password]) { 


[GameCrash]

This is because 2.0.3 didn't have password encryption... The line should be

PHP Code:

if ($loginpassword!=$bbuserinfo[password]) { 


[Lesane]

[QUOTE]Originally posted by GameCrash
This is because 2.0.3 didn't have password encryption... The line should be

PHP Code:

if ($loginpassword!=$bbuserinfo[password]) { 


[VirtueTech]

I don't think I need to install this hack if I use htaccess to protect the directory ..correct?

Because if they don't get past the HTACCESS then they won't be able to trip the code to email me.

[JJR512]

You might want to use this hack anyway. If someone does manage to get past the .htaccess password block, you'll never know just from that. But unless you use the same password for the .htaccess block as you do for your admin account, after they break past the .htaccess block, they'll trip this hack next.

[Prezident]

I was just thinking about this the other night.

I have other directories on my webserver that are protected by .htaccess, and thought it would be nice to have people who were not able to authenticate within the 3 try limit to be sent to a custom error page that would also send me an email with some information about their IP address.

I know this is not related to vBulletin, but this hack is what got me thinking about that.