Support/Comments for PHPIDS 0.6.1.1b-update

On PHPIDS is a new release available.

All the changed up to the latest beta will be available under the name PHP-IDS, because I couldn’t revert the wrong version number of the initial release.
This release will be available after a system administrator took a look over it.

Thanks to all for their ideas, especially Jako.

By accident I found out, that the new PHP-IDS Plugin was published, I got no mail about it. Currently there is no forum entry available.

You find PHP-IDS at http://modxcms.com/extras/package/585.

hello everyone,

in times of threat this plugin is indispensability.
My question is can someone make detailed tutorial how install and make working,

Regards

Hello Kristalin,

There is a detailed installation tutorial available at http://modxcms.com/extras/package/585.

You must only download PHPIDS from http://php-ids.org/downloads/, extract the archive, start a FTP client and load the files to your webserver.
The PHP-IDS plugin uses assets/lib/phpids/lib as the default path, but you can use any path you want, because you can configure the path with the plugin.

All defaults are set to useful values, without the mail recipients:



If I want to block someone, I do it with the IP-address inside the htaccess file.

Currently the plugin does not block someone automatically or with a module manually, it only warns about possible intrusions. If you want to know more about this, you might read an article at http://www.h-online.com/security/Getting-started-with-the-PHPIDS-intrusion-detection-system--/features/113163.

Hi Stefanie,

first thank you for patience.
I install and configure PHPIDS and i thing is work correct.
(make test with: " ?test=’%20OR%201=1-- " and other example possibly for attacks - and i get warring mail.)
My another question is can i make automatically block someone.
( i read http://www.h-online.com/security/Getting-started-with-the-PHPIDS-intrusion-detection-system--/features/113163 , but i cant find example for automatically block )


Thanks

No, currently it is not a blocking system, it is only a system to warn users of possible intrusions.
As I’ve seen through the PHPIDS logs on several systems, an automatic blocking will cause some trouble, because it will block people, that should not been blocked at all.
I will not develop an automatic blocking, because at least, I would be the one who blocked someone, and users will tell me, that I would be responsible.

But what I’m thinking about is to create a module, that will list the intrusions by their IP address and give the user the possibility to look for details and to block a user.
I think there should be two possibilities of blocking:

• With htaccess file
• Forward to a document

As htaccess files don’t work on windows systems with IIS, my idea is to show users only one document with a message.
But it will take a wile until this will be finished, because that is more work, than coding this plugin until now.

Hi,

i understand reason`s.
I have new question...i get this error log:


(maybe this is one good example why automatically block is not perfect idea)
every new refresh in the web page i get new error similar...

can you an explanation?

Thanks

For me, this looks like a Google Analytics value of a cookie.
And 12 is not a high impact classification.

Where i can read which impact is for what?
Something like documentation...
-
Thank you!

For further information take a look at www.php-ids.org.