Support/Comments for PHPIDS 6.1.1-released

☆ A M B ☆
1,031 Posts

Jako Reply #11, 17 years ago

The plugin just reports what it thinks are attacks.

PHPIDS returns the impact of the probably attack as a value. Depending of this value the plugin could be extended to display an ’play your games elsewhere’ page. A useful extension would be the collection of repeating attacs during the same session.

I’m quite interested in the module code and the phpmailer patch. Maybe you can provide it here.

964 Posts

charliez Reply #12, 17 years ago

yo también... me too....

Website: www.mercologia.com
MODX Revo Tutorials: www.modxperience.com

MODX Professional Partner

222 Posts

Stefanie Reply #13, 17 years ago

The article mentioned at the plugin is very good to get a first impression what PHPIDS is about: http://www.h-online.com/security/Getting-started-with-the-PHPIDS-intrusion-detection-system--/features/113163. The idea of doing this plugin came to me while reading this article.

Currently I’m using some reports done with iReport do get statistics about intrusions. That is much more flexible as to load the data into a grid and just show them.

If I have to exclude someone, I’m also doing this in a htaccess file. But the idea of Jako to add a function to send attackers to nothing is a nice idea.

Gone away and found a better place to stay

☆ A M B ☆
1,031 Posts

Jako Reply #14, 17 years ago

@Susan: You’ve forgotten the db host in the config lines. And I think it would be better to use the table_prefix for the intrusion table.

        $init->config['Logging']['wrapper'] = 'mysql:host='.$modx->db->config['host'].';port=3306;dbname='.trim($modx->db->config['dbase'], '`');
        $init->config['Logging']['user'] = $modx->db->config['user'];
        $init->config['Logging']['password'] = $modx->db->config['pass'];
        $init->config['Logging']['table'] = $modx->db->config['table_prefix'].'phpids_intrusions';

The lines to create the intrusions table (change the prefix for the specific installation)

CREATE TABLE IF NOT EXISTS `modx_phpids_intrusions` (
      `id` int(11) unsigned NOT null auto_increment,
      `name` varchar(128) NOT null,
      `value` text NOT null,
      `page` varchar(255) NOT null,
      `tags` varchar(128) NOT null,
      `ip` varchar(15) NOT null,
      `impact` int(11) unsigned NOT null,
      `origin` varchar(15) NOT null,
      `created` datetime NOT null,
      PRIMARY KEY  (`id`)
    ) ENGINE=MyISAM ;

2,204 Posts

Dimmy Reply #15, 17 years ago

This is great
susan do you have the module available?

follow me on twitter: @dimmy01

222 Posts

Stefanie Reply #16, 17 years ago

Thanks for all comments and the great ideas.

There is a beta version available on my webserver: modx.phpids.0.6.1.1c.BETA.zip.

This version includes all ideas mentioned above:

Automatic table creation
Using MODx database connection
Using SMTP if filled

Please test the new version of this plugin, especially using SMTP, and give me a feedback.

Gone away and found a better place to stay

222 Posts

Stefanie Reply #17, 17 years ago

There is a new beta version available at
modx.phpids.0.6.1.1c.BETA2.zip

Changes in this version:

Using default SMPT Port 25
Extended the SMTP Message, that is send

Please test the new version of this plugin and give me a feedback.
I am also interested in any new ideas.

Gone away and found a better place to stay

☆ A M B ☆
1,031 Posts

Jako Reply #18, 17 years ago

Some small corrections:

Line 62:

$modx->logEvent(0, 2, printf( 'PHPIDS Plugin: PHPIDS path not set!'));

Line 65:

$modx->messageQuit ('PHPIDS Plugin: PHPIDS path not set!');

Line 190:

$tableName = $modx->db->config['table_prefix'] . 'phpids_intrusions';

222 Posts

Stefanie Reply #19, 17 years ago

Thanks to Jako, there are some corrections done.

In addition I’ve added the IP of the potential attacker to the MODx log. I wanted to store it in the source field, but this field is only varchar(50) and therefore, it is to short.
The IP is added to the text at the first line.

There where also some printf where it should be sprintf, that is corrected now.

The new beta is available at modx.phpids.0.6.1.1c.BETA3.zip

Btw: Is there a way to change the version number? I’ve done a copy and paste failure, the version should have been named 0.6.1.1 instead of 6.1.1. With editing the plugin I was not able to do it. My problem now is, if I use the correct version number, all new versions will be shown as a previous version, because 0.6.1.1 is smaller than 6.1.1.

Gone away and found a better place to stay

222 Posts

Stefanie Reply #20, 17 years ago

As mentioned by BobRay in Support/Comments for PHPIDS 0.6.1.1b-update, there is a new beta available, to cover all possible writings of tRuE wink

:

The new beta is available at modx.phpids.0.6.1.1c.BETA4.zip.

Gone away and found a better place to stay