-
☆ A M B ☆
- 24,524 Posts
Really excited about this; trying to get it working on my site now. Fought paths and won. Still fighting database usage.
I installed phpids (the lib directory only) in a new directory "intrusion" above my web root (public_html) which may or may not work depending on how your server is configured to allow/disallow access outside of the web root by php scripts. I found I needed to set the basePath value to ../instrusions/ to get the files included properly.
I’m still working on getting database access into tables in the default MODx database. I plan to make a module for displaying the logs, and depending on how it looks, for dealing with blacklisting persistent bad IPs, maybe even temporary blocks to stop DOS attacks without permanently blocking the offending IPs. Lots of potential here!
-
☆ A M B ☆
- 24,524 Posts
Found two typos
1. In the configuration string, the email option had an extraneous $
&$useEmail=Use email;list;true,false;false
2. In the plugin code, line 66 has a double slash in the path to the log file:
$init->config['General']['base_path'] = $basePath . '//IDS/';
-
☆ A M B ☆
- 24,524 Posts
I’m experimenting with using the MODx config information to feed phpids the database information without having to edit their config file.
And here it is; around line 68 of the plugin add
$init->config['Logging']['wrapper']='mysql:host=localhost;port=3306;dbname=' . trim($modx->dbConfig['dbase'], '`');
$init->config['Logging']['user']=$modx->dbConfig['user'];
$init->config['Logging']['password']=$modx->dbConfig['pass'];
$init->config['Logging']['table']='intrusions';
-
☆ A M B ☆
- 24,524 Posts
Hm. Even though I’ve set everything except database logging to false, I’m getting everything (except mail, since the PHP mail() function doesn’t work on my server). I had to change the conditionals
if ($useLogFile != 'false' && $impact >= $logFromImpact) {
...
if ($useEmail != 'false' && $impact >= $sendMailFromImpact) {
...
if ($useDatabase != 'false' && $impact >= $logFromImpact) {
...
if ($useMODXLog !='false' && $impact >= $logFromImpact) {
-
☆ A M B ☆
- 24,524 Posts
Ok, now I’m happy with it. If anybody else needs SMTP mail, and really wants email notification, I’ll add using the phpmailer class to the plugin. I’ll even pretty up the report
-
☆ A M B ☆
- 24,524 Posts
Wow! This is impressive! I’ve created a module to view the records, and just as I was testing it I got hit with a whole bunch of attempts at the snippet.reflect.php file (which used to be included in the assets/snippets/reflect directory). Take a look at it with the guest login to my Manager, Modules -> PHPIDS. (for best viewing close the Document Tree by clicking on the little box icon at the right of the Document Tree’s toolbar)
uuuuh - interesting & scary
btw, i’ve seen a lot of requests for the reflect file in my server-logs on a static website i mentioned here in the forum once. the site wasn’t exposed or mentioned anywhere else.
what is this module exactly doing? will it just inform you that an attack is executed at the moment, or will it somehow prevent an attack ?
-
☆ A M B ☆
- 24,524 Posts
The plugin just reports what it thinks are attacks. The underlying PHPIDS can be configured; I’m just running it pretty much out-of-the-box.
The module I’ve made only displays the records from the database. I’ve banned that ip address with my .htaccess file, by the way.
I’ll probably fiddle with the module, adding searching and sorting (maybe if I’m really feeling energetic an AJAX data grid), and possibly even adding editing of the ban list for .htaccess in the module. I’m thinking of something along the lines of automatically banning an IP address if it generates more than x number of attempts at y impact, configurable in the module’s configuration.
