Go Back   vb.org Archive > vBulletin Modifications > Archive > vB.org Archives > vBulletin 3.0 > vBulletin 3.0 Beta Releases
FAQ Community Calendar Today's Posts Search

Reply
 
Thread Tools
Secure Login by IP (bit matching with masks) Details »»
Secure Login by IP (bit matching with masks)
Version: .1, by Tekton Tekton is offline
Developer Last Online: Jun 2009 Show Printable Version Email this Page

Version: 3.0.6 Rating:
Released: 02-12-2005 Last Update: Never Installs: 2
DB Changes
Is in Beta Stage  
No support by the author.

___________
PRE DISCLAIMER: This beta hack has been tested and DOES work; however it IS beta so use at your own risk. (I'm not responsible, etc etc)

???????????
Apparently someone was making a much cooler Draft hack than me (although they've vanished for almost a month now), so I decided to do this in some of my free time. I did a little searching and found no hacks like this, but if there is: please tell me.

Estimated Install Time: ???? [Any questions? This thread only please ]

What is it: This hack allows you the possibility to limit your account login to certain IP addresses (or IP ranges). This would stop people that find out your password if you enable secure login on certain IP addresses (users DON'T have to specify any or do anything and it will work just like it would normally). This is mainly for people concerned with security I guess, plus it's kinda cool as long as you're careful and if you want to restrict access. If someone aquires your password, this would prevent them from using it possibly.

Why is it beta: I haven't had much time to test it out, and I'm not sure how well the checkbit-masking works even though I coded it to be honest ^^;; -- so that's why. It'd be great if you guys/girls could help out. (and the code is kinda sloppy at the moment)

Images:::::::::::::::::::::::::::::::::::

// ###### INSTALLATION ######
First: Using PHPMYADMIN, or your preferred SQL tool, run this query in your vB database.
[sql]ALTER TABLE `user` ADD `secure_ip` VARCHAR( 150 ) DEFAULT '0.0.0.0~0.0.0.0~0!0.0.0.0~0.0.0.0~0!0.0.0.0~0.0.0 .0~0' NOT NULL ;[/sql]
NOTE: Add your table prefix if you have one!
??????????????????????
IN profile.php FIND:
PHP Code:
if ($_REQUEST['do'] == 'editpassword')

BELOW, ADD:
PHP Code:
//======= VE SECURE-LOGIN START -->

$ve_a=0$ve_b=0$ve_c=0$ve_construct=""$ve_secure_login=""$ve_sec_group=array(); $ve_sub_s=array(); $ve_sub_ip=array(); $ve_sub_check=array(); // inits

$ve_sec_group=explode("!"$bbuserinfo[secure_ip]);

while(
$ve_b<3){ $ve_a++;
$ve_sub_s=explode("~"$ve_sec_group[$ve_b]);
$ve_sub_ip=explode("."$ve_sub_s[0]);
$ve_sub_check=explode("."$ve_sub_s[1]);
if(
$ve_sub_s[2]==1){$ve_ischeck="checked";}else{$ve_ischeck="";}

$ve_construct.="
<tr><td nowrap='nowrap'><div>
<input type='text' class='bginput' name='ves_i"
.$ve_a."1' value='".$ve_sub_ip[0]."' size='3' maxlength='3'/> .
<input type='text' class='bginput' name='ves_i"
.$ve_a."2' value='".$ve_sub_ip[1]."' size='3' maxlength='3'/> .
<input type='text' class='bginput' name='ves_i"
.$ve_a."3' value='".$ve_sub_ip[2]."' size='3' maxlength='3'/> .
<input type='text' class='bginput' name='ves_i"
.$ve_a."4' value='".$ve_sub_ip[3]."' size='3' maxlength='3'/>
</div></td><td nowrap='nowrap' width='6'>|</td><td nowrap='nowrap'><div>
<input type='text' class='bginput' name='ves_c"
.$ve_a."1' value='".$ve_sub_check[0]."' size='3' maxlength='3'/> .
<input type='text' class='bginput' name='ves_c"
.$ve_a."2' value='".$ve_sub_check[1]."' size='3' maxlength='3'/> .
<input type='text' class='bginput' name='ves_c"
.$ve_a."3' value='".$ve_sub_check[2]."' size='3' maxlength='3'/> .
<input type='text' class='bginput' name='ves_c"
.$ve_a."4' value='".$ve_sub_check[3]."' size='3' maxlength='3'/>
</div></td><td nowrap='nowrap'><input type='checkbox' "
.$ve_ischeck." name='ves_u".$ve_a."' value='1'> Use This Set</td></tr>"$ve_b++;}

$ve_secure_login="<fieldset class='fieldset'><legend>VE SECURE-LOGIN</legend>
<table cellpadding='0' cellspacing='
$stylevar[formspacer]' border='0'>
<tr><td colspan='4' style='border-color: #000000; border-style: solid; border-width: 0px 0px 1px 0px;'>Secure your account by only allowing the IP addresses below to login.  
The 'Check Bits' field allows you to specify how much of the IP address to check.  
It's values are binary represented by a decimal number. ('255.255.0.0' will check the 
first two octets of your entered IP.</td></tr><tr><td><div>IP Address:</div></td><td></td><td><div>Check Bits:</div></td></tr>"
.$ve_construct."<tr><td colspan='3'>
CAUTION: Do not set these values if you do not know what you're 
doing as it could cause you to lock yourself out of your account!</td></tr></table></fieldset>"
;

//======= <-- VE SECURE-LOGIN END 
NEXT, FIND:
PHP Code:
            eval(print_standard_error('passwordhistory'));
        }

    } 
BELOW, ADD:
PHP Code:
//======= VE SECURE-LOGIN UPDATE START -->

// grab values => int 'em
$ve_new_i1[0]=intval($_POST['ves_i11']);$ve_new_i1[1]=intval($_POST['ves_i12']);$ve_new_i1[2]=intval($_POST['ves_i13']);$ve_new_i1[3]=intval($_POST['ves_i14']);
$ve_new_i2[0]=intval($_POST['ves_i21']);$ve_new_i2[1]=intval($_POST['ves_i22']);$ve_new_i2[2]=intval($_POST['ves_i23']);$ve_new_i2[3]=intval($_POST['ves_i24']);
$ve_new_i3[0]=intval($_POST['ves_i31']);$ve_new_i3[1]=intval($_POST['ves_i32']);$ve_new_i3[2]=intval($_POST['ves_i33']);$ve_new_i3[3]=intval($_POST['ves_i34']);
$ve_new_c1[0]=intval($_POST['ves_c11']);$ve_new_c1[1]=intval($_POST['ves_c12']);$ve_new_c1[2]=intval($_POST['ves_c13']);$ve_new_c1[3]=intval($_POST['ves_c14']);
$ve_new_c2[0]=intval($_POST['ves_c21']);$ve_new_c2[1]=intval($_POST['ves_c22']);$ve_new_c2[2]=intval($_POST['ves_c23']);$ve_new_c2[3]=intval($_POST['ves_c24']);
$ve_new_c3[0]=intval($_POST['ves_c31']);$ve_new_c3[1]=intval($_POST['ves_c32']);$ve_new_c3[2]=intval($_POST['ves_c33']);$ve_new_c3[3]=intval($_POST['ves_c34']);
$ve_use[0]=$_POST['ves_u1'];$ve_use[1]=$_POST['ves_u2'];$ve_use[2]=$_POST['ves_u3']; $ve_sec_string="";

// make sure they are good vals else set to zero~
$ve_wh=0;while($ve_wh<4){
if(
$ve_new_i1[$ve_wh]>255||$ve_new_i1[$ve_wh]<0){$ve_new_i1[$ve_wh]=0;}
if(
$ve_new_c1[$ve_wh]>255||$ve_new_c1[$ve_wh]<0){$ve_new_c1[$ve_wh]=0;}
if(
$ve_use[$ve_wh]!=1){$ve_use[$ve_wh]=0;}
$ve_wh++;}

// combine into a settable value and UPDATE!
$ve_sec_string=
implode("."$ve_new_i1)."~".implode("."$ve_new_c1)."~".$ve_use[0]."!".
implode("."$ve_new_i2)."~".implode("."$ve_new_c2)."~".$ve_use[1]."!".
implode("."$ve_new_i3)."~".implode("."$ve_new_c3)."~".$ve_use[2];
$DB_site->query("UPDATE ".TABLE_PREFIX."user SET secure_ip = '$ve_sec_string' WHERE userid = '$bbuserinfo[userid]'");

//======= <-- VE SECURE-LOGIN UPDATE END 

??????????????????????
IN includes/functions_login.php FIND:
PHP Code:
function verify_authentication($username$password$md5password$md5password_utf$send_cookies)
{
    global 
$DB_site$bbuserinfo$_REQUEST$_COOKIE;

    
$username strip_blank_ascii($username' '); 
BELOW, ADD:
PHP Code:
//======= VE SECURE-LOGIN CHECK START -->
$ve_secure_check $DB_site->query_first("SELECT userid, username, secure_ip FROM ".TABLE_PREFIX."user WHERE username = '".addslashes(htmlspecialchars_uni($username))."'");

$ve_a=0$ve_c=0$ve_construct=""$ve_secure_login=""$ve_ip IPADDRESS$ve_can_login=array();
$ve_can_login[0]=0$ve_can_login[1]=0$ve_can_login[2]=0;
$ve_sec_group=array(); $ve_sub_s=array(); $ve_sub_ip=array(); $ve_sub_check=array();
$ve_sec_group=explode("!"$ve_secure_check[secure_ip]);
$ve_sub1=explode("~"$ve_sec_group[0]);$ve_ip1=explode("."$ve_sub1[0]);$ve_check1=explode("."$ve_sub1[1]);
$ve_sub2=explode("~"$ve_sec_group[1]);$ve_ip2=explode("."$ve_sub2[0]);$ve_check2=explode("."$ve_sub2[1]);
$ve_sub3=explode("~"$ve_sec_group[2]);$ve_ip3=explode("."$ve_sub3[0]);$ve_check3=explode("."$ve_sub3[1]);

$ve_ip1[0]=base_convert($ve_ip1[0], 102);$ve_ip1[1]=base_convert($ve_ip1[1], 102);$ve_ip1[2]=base_convert($ve_ip1[2], 102);$ve_ip1[3]=base_convert($ve_ip1[3], 102);
$ve_check1[0]=base_convert($ve_check1[0], 102);$ve_check1[1]=base_convert($ve_check1[1], 102);$ve_check1[2]=base_convert($ve_check1[2], 102);$ve_check1[3]=base_convert($ve_check1[3], 102);
$ve_ip2[0]=base_convert($ve_ip2[0], 102);$ve_ip2[1]=base_convert($ve_ip2[1], 102);$ve_ip2[2]=base_convert($ve_ip2[2], 102);$ve_ip2[3]=base_convert($ve_ip2[3], 102);
$ve_check2[0]=base_convert($ve_check2[0], 102);$ve_check2[1]=base_convert($ve_check2[1], 102);$ve_check2[2]=base_convert($ve_check2[2], 102);$ve_check2[3]=base_convert($ve_check2[3], 102);
$ve_ip3[0]=base_convert($ve_ip3[0], 102);$ve_ip3[1]=base_convert($ve_ip3[1], 102);$ve_ip3[2]=base_convert($ve_ip3[2], 102);$ve_ip3[3]=base_convert($ve_ip3[3], 102);
$ve_check3[0]=base_convert($ve_check3[0], 102);$ve_check3[1]=base_convert($ve_check3[1], 102);$ve_check3[2]=base_convert($ve_check3[2], 102);$ve_check3[3]=base_convert($ve_check3[3], 102);

// pad the real IP
$ve_ips=explode("."$ve_ip);
$ve_ips[0]=base_convert($ve_ips[0], 102);$ve_ips[1]=base_convert($ve_ips[1], 102);
$ve_ips[2]=base_convert($ve_ips[2], 102);$ve_ips[3]=base_convert($ve_ips[3], 102);
$ve_ips[0]=str_pad($ve_ips[0], 8"0"STR_PAD_LEFT);
$ve_ips[1]=str_pad($ve_ips[1], 8"0"STR_PAD_LEFT);
$ve_ips[2]=str_pad($ve_ips[2], 8"0"STR_PAD_LEFT);
$ve_ips[3]=str_pad($ve_ips[3], 8"0"STR_PAD_LEFT);


// first_IP
$ve_b=0; while($ve_b<4){
$ve_check1[$ve_b]=str_pad($ve_check1[$ve_b], 8"0"STR_PAD_LEFT);
$ve_ip1[$ve_b]=str_pad($ve_ip1[$ve_b], 8"0"STR_PAD_LEFT);
$ve_d=0; while($ve_d<8){
if(
$ve_check1[$ve_b]{$ve_d}==1&&$ve_ips[$ve_b]{$ve_d}!=$ve_ip1[$ve_b]{$ve_d}){$ve_can_login[0]+=1;}
$ve_d++;}$ve_b++;}

// second_IP
$ve_b=0; while($ve_b<4){
$ve_check2[$ve_b]=str_pad($ve_check2[$ve_b], 8"0"STR_PAD_LEFT);
$ve_ip2[$ve_b]=str_pad($ve_ip2[$ve_b], 8"0"STR_PAD_LEFT);
$ve_d=0; while($ve_d<8){
if(
$ve_check2[$ve_b]{$ve_d}==1&&$ve_ips[$ve_b]{$ve_d}!=$ve_ip2[$ve_b]{$ve_d}){$ve_can_login[1]+=1;}
$ve_d++;}$ve_b++;}

// third_IP
$ve_b=0; while($ve_b<4){
$ve_check3[$ve_b]=str_pad($ve_check3[$ve_b], 8"0"STR_PAD_LEFT);
$ve_ip3[$ve_b]=str_pad($ve_ip3[$ve_b], 8"0"STR_PAD_LEFT);
$ve_d=0; while($ve_d<8){
if(
$ve_check3[$ve_b]{$ve_d}==1&&$ve_ips[$ve_b]{$ve_d}!=$ve_ip3[$ve_b]{$ve_d}){$ve_can_login[2]+=1;}
$ve_d++;}$ve_b++;}

// Make sure they don't count if they are disabled
if($ve_sub1[2]==0){$ve_can_login[0]=0;}
if(
$ve_sub2[2]==0){$ve_can_login[1]=0;}
if(
$ve_sub3[2]==0){$ve_can_login[2]=0;}

//======= <-- VE SECURE-LOGIN CHECK END 
NEXT, FIND:
PHP Code:
if (
            
$bbuserinfo['password'] != iif($password AND !$md5passwordmd5(md5($password) . $bbuserinfo['salt']), '') AND
            
$bbuserinfo['password'] != md5($md5password $bbuserinfo['salt']) AND
            
$bbuserinfo['password'] != iif($md5password_utfmd5($md5password_utf $bbuserinfo['salt']), '')
        ){return 
false;} 
BELOW, ADD:
PHP Code:
//======= VE SECURE-LOGIN DENY START -->
if ($ve_can_login[0]>0||$ve_can_login[1]>0||$ve_can_login[2]>0){return false;}
//======= <-- VE SECURE-LOGIN DENY END 
??????????????????????
IN "Modify User Option Templates" modifypassword TEMPLATE FIND:
HTML Code:
<div><input type="text" class="bginput" name="emailconfirm" value="$bbuserinfo[email]" size="50" maxlength="50" /></div>
				</td>
			</tr>
			</table>
		</fieldset>
BELOW, ADD:
HTML Code:
$ve_secure_login
// ###### END INSTALLATION ######
DONE! PLEASE let me know what you think and help me find the bugs; I KNOW they're in there!

Explanation:
Setting an IP to "12.14.x.x" with the check bits "255.255.0.0" will check the first two octets ("12.14") of the IP address.
x=any value from 0-255

It matches up the bits in the user's IP address to the ones stored for each bit, like so:
11110000.00000100.00000000.00000010 (240.0.4.2) <-- user's IP
11110000.00000100.00000000.00000001 (240.0.4.1) <-- IP stored
11111111.11111111.11111111.00000000 (255.255.255.0) <-- Check Bits

It will only check the bits you have enabled in the "Check Bits" field, so the above example would allow the IP "204.0.4.2" INTO THE ACCOUNT even though it is set to 204.0.4.1 because of the check bits.

There IS some limitation to this method.

___________
POST DISCLAIMER: This beta hack has been tested and DOES work; however it IS beta so use at your own risk. (I'm not responsible, etc etc)

???????????

Show Your Support

  • This modification may not be copied, reproduced or published elsewhere without author's permission.

Comments
  #2  
Old 02-13-2005, 08:34 PM
Tekton Tekton is offline
 
Join Date: Jun 2004
Location: Wisconsin
Posts: 362
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

I have something to add here. (soon)
Reply With Quote
  #3  
Old 02-13-2005, 09:13 PM
Tekton Tekton is offline
 
Join Date: Jun 2004
Location: Wisconsin
Posts: 362
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

IMPORTANT: I forgot to add the "SECURE-LOGIN UPDATE" code, so if you read this before, please note that it is now in the code on the above section!

Oops.
Reply With Quote
  #4  
Old 02-13-2005, 09:25 PM
nexialys
Guest
 
Posts: n/a
Default

would be good to have an install script, or a .txt so we can save it on a real format...
Reply With Quote
  #5  
Old 02-13-2005, 09:42 PM
Tekton Tekton is offline
 
Join Date: Jun 2004
Location: Wisconsin
Posts: 362
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by nexialys
would be good to have an install script, or a .txt so we can save it on a real format...
I don't like install scripts, but I can put it all in a text file if you want.
Reply With Quote
  #6  
Old 02-14-2005, 12:31 AM
nighteyes's Avatar
nighteyes nighteyes is offline
 
Join Date: Oct 2001
Posts: 130
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Would love to install this but I fear too many newbies will be locking themselves out of their accounts and support tickets will go through the roof. GREAT idea though!
Reply With Quote
  #7  
Old 02-14-2005, 03:07 AM
Remi Remi is offline
 
Join Date: Nov 2001
Location: London, UK
Posts: 196
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

thanks for sharing this hack

Is it posible to restrict the use of this hack to one group, superadmin for example.

Thanks
Reply With Quote
  #8  
Old 02-14-2005, 03:16 AM
Johnny's Avatar
Johnny Johnny is offline
 
Join Date: Jun 2002
Posts: 290
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

this is a interesting hack but if i was a new person to the web i would be lost on what to do at registration page so i can protect my account. It would be better if it was just a usercp option if you decide if u want your account more secure or have a cp option to do future edits.
Reply With Quote
  #9  
Old 02-14-2005, 03:56 AM
Tekton Tekton is offline
 
Join Date: Jun 2004
Location: Wisconsin
Posts: 362
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Remi
thanks for sharing this hack

Is it posible to restrict the use of this hack to one group, superadmin for example.

Thanks
Well, you could just add a template conditional to hide it from normal members if you want. Just change the "$ve_secure_login" to:

HTML Code:
<if condition="$bbuserinfo[usergroupid]==6">
$ve_secure_login
</if>
I DON'T know if that actual code will work, since I didn't test it, but yo could create any other sort of conditional like that. Another option would be to add the if in the construct php code.
Reply With Quote
  #10  
Old 02-14-2005, 03:58 AM
Tekton Tekton is offline
 
Join Date: Jun 2004
Location: Wisconsin
Posts: 362
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Johnny
this is a interesting hack but if i was a new person to the web i would be lost on what to do at registration page so i can protect my account. It would be better if it was just a usercp option if you decide if u want your account more secure or have a cp option to do future edits.
As far as I know, this ONLY shows up in one section of the user cp, and not at all on registration stuff.
Reply With Quote
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 02:25 PM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.12593 seconds
  • Memory Usage 2,452KB
  • Queries Executed 23 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (3)bbcode_html
  • (8)bbcode_php
  • (3)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)modsystem_post
  • (1)navbar
  • (6)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (10)post_thanks_box
  • (10)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (10)post_thanks_postbit_info
  • (9)postbit
  • (9)postbit_onlinestatus
  • (10)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete