Administrative and Maintenance Tools - Password Security Tools

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Password Security Tools
For vBulletin 3.7.0 and above
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Description
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
A product designed to combat the recent increase in weak password attacks by spammers.

For background information, read the following threads:
http://www.vbulletin.com/forum/showthread.php?t=278975
http://www.vbulletin.com/forum/showthread.php?t=281371

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Problem
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The problem stems from the fact that vBulletin doesn't check the quality of a user's password when registering or changing the password in the User CP. As a result, users are able to choose easily guessable passwords to protect their account. The most common passwords are things like "password", "12345", "qwerty", "letmein", as well as the user's own username. On a large forum, these poorly protected accounts can number hundreds or even thousands, and this has shown itself to be a prime opportunity for spammers to exploit. With a relatively simple script, spammers are able to scrape the member list from your forum and automatically validate which of the accounts have such passwords. A spammer with access to tens, hundreds or thousands of legitimate user accounts is a situation you don't want to be in.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
What This Does
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
This product has two main functions.
1. It prevents users from using their own username as a password, or any other commonly used word. (An editable list of banned passwords is available in the Admin CP.) The same rules apply if a user tries to change their password after registration.
2. It provides you with a tool to identify existing user accounts that have bad passwords, and lets you reset those passwords. Emails will be automatically dispatched to affected users notifying them of the change, and providing instructions on how to gain access to their account.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Installation
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
To install:
1. Upload cpnav_passrepair.xml to includes/xml/
2. Upload passsec.php to admincp/
3. Upload product-passrepair.xml to your Admin CP as a product
4. Enable the product in vBulletin Options

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Password Scanner - Usage Notes
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The password scanning portion of this product is a utility designed for use by administrators. There are a few things to be aware of.
1. BACK UP YOUR DATA BEFORE USING THIS SCRIPT.
2. It's not a tool designed for frequent usage, it's a quick and dirty way of getting the job done. If Jelsoft don't address this issue, I might return to it and optimize the password scanner to make it a little less server intensive. Use it sparingly, and close your forums before commencing a scan.
3. The password scanner has the potential to send out a lot of email. Use the "Users Per Page" setting to process accounts at whatever rate you deem your server capable of handling.
4. After you've installed this product it'll be impossible for users to register using a blacklisted or invalid password (or to change it to one afterwards). As a result, you should only need to use the password scanner once. Feel free to remove the passsec.php and cpnav_passrepair.xml files from your server once you're done with the scanner, the rest of the product will still function.
5. For unattended bulk processing of accounts, there's some javascript in passsec.php that's currently commented out. Use it at your own risk.

[LCN2007]

so vb does this now? what version?

From what i read in this thread it seems that this mod is better since it includes bad word list.

[LCN2007]

I looked up the vb update.

Username=Password Disallowed

In this release, users will no longer be allowed to set their username and passwords to the same value. Users who already have a password that is the same as their username will be forced to change their password on their next login. Additionally, a tool has be added to the Admin Control Panel to email affected users with a new password. Please be aware of these potential compatibility changes when upgrading.

I still think that this mod is still better than what vb has done since they only addressed 1/2 the problem and since i haven't upgrade to 3.7.3 yet. I need to renew my vb membership.

I just wish there was a way to mandate a min password length on the forum.

Great mod John thank you for this.

[MessageParis1]

Originally Posted by LCN2007

I looked up the vb update.


I still think that this mod is still better than what vb has done since they only addressed 1/2 the problem and since i haven't upgrade to 3.7.3 yet. I need to renew my vb membership.

I just wish there was a way to mandate a min password length on the forum.

Apologies for reviving such an old thread, but I just discovered this add-on and it works great with my 3.8.4 installation. However I wanted to do at least something to enforce a minimum password length, so I modified the verify_passwords javascript function in the register template (changes are in red):

<script type="text/javascript">
function verify_passwords(password1, password2, minlength)
{
	// do various checks, this will save people noticing mistakes on next page
	if (password1.value == '' || password2.value == '')
	{
		alert('$vbphrase[fill_out_both_password_fields]');
		return false;
	}
	else if (password1.value != password2.value)
	{
		alert('$vbphrase[entered_passwords_do_not_match]');
		return false;
	}
	else if (password1.value.length < minlength)
	{
		alert('Your password is too short. It has to be at least ' + minlength + ' characters');
		return false;
	}

	else
	{
		<if condition="$show['coppa']">
		pass_copy = password1.value;
		passconfirm_copy = password2.value;
		</if>

		var junk_output;

		md5hash(password1, document.forms.register.password_md5, junk_output, $show[nopasswordempty]);
		md5hash(password2, document.forms.register.passwordconfirm_md5, junk_output, $show[nopasswordempty]);

		<if condition="$show['coppa']">
		document.forms.register.password.value = pass_copy;
		document.forms.register.passwordconfirm.value = passconfirm_copy;
		</if>

		return true;
	}
	return false;
}
</script>

and immediately after in the same register template:

<form action="register.php?do=addmember" name="register" method="post" onsubmit="return verify_passwords(password, passwordconfirm, 8);">

[adwade]

the MOD states: "After confirming your email address is valid, we'll send you your new password." in an email to users, but I don't see anywhere how many characters the new/generated Password is. I assume it's a random mix of letters/numbers, but how l-o-n-g is the password it refers to?

[adwade]

Originally Posted by MessageParis1

Apologies for reviving such an old thread, but I just discovered this add-on and it works great with my 3.8.4 installation. However I wanted to do at least something to enforce a minimum password length, so I modified the verify_passwords javascript function in the register template

That worked PERFECTLY, but I have one other question. If a user chooses to later revise their password via the UserCP (i.e. profile.php?do=editpassword function) then they are no longer held to an 8 Character Minimum Length password since this type CODE does not exist there.

Does anyone have an idea as to what additional CODE one would need to insert into the profile.php file to force users to always update their passwords using at least 8 characters? Or should such revisions be made in the modifypassword template?

[markslevent]

Thanks a lot.It worked for me on 3.8.7.