Admin Secure 1.7 comes with tons of new features: Safe Requests Mode will force any request strings containing dangerous strings signatures (union, join, exec, select, insert, grant, etc) translated as HTML entities; Safe HTML Strings will translating "<" and ">" characters into < and > entities, respectively. This will always prevent users submitting any of HTML formatted text. Both of them are extreme features intended for paranoid administrators.
Another features are comes from people's requests: Site Close/Open option, Delete unapproved admins (even they're God Admins) in Admin Approval page, SQL injection and forbidden HTML tags deep scanning modes, visitor's tracking system, maximum allowable visitors at the same time, and more. Version 1.7 also comes with better appearances and layouts for conveniences.
Features:
- Blocking known PHP-Nuke exploits.
- Prevent fake admin account access through input requests.
- Blocking cross-site scripting in modules.php and index.php files.
- Ensuring admin account session taken from cookie.
- Prevent unauthorized admin account creation, deletion, and modification.
- Compare admin account validity through "mirrored" database table.
- Changes to admin accounts (create, edit, delete) require God admin approval.
- E-mail notification. An alert sent along with additional info.
- Banning system for accessing site and PHP-Nuke modules.
- Log site activities.
- Flood Protection.
- And more.
Changes in This Version:
- Add: Safe Requests Mode
- Add: Safe HTML Strings
- Add: Automatic Database Checking (thanks to Anonymous)
- Add: Automatic Database Optimization (thanks to Anonymous)
- Add: Site Close/Open option in Administration Panel
- Add: Unapproved admin accounts deletion from Administration Panel
- Add: Confirmation Prompt
- Add: Selectable Blocking page (either html page or server response codes)
- Add: SQL Injection deep scanning mode (thanks to Anonymous)
- Add: Illegal HTML Tags deep scanning mode (thanks to Anonymous)
- Add: Tracking System (thanks to John1000)
- Add: Maximum Site Visitors (thanks to John1000)
- Add: Send mail notification as MIME mail
- Add: Send mail notification using IMAP (if supported by server)
- Upd: Strengthen Admin Secure global variables
- Upd: Improve Admin Secure Administration Panel interface
- Upd: Improve SQL Injection checking algorithm
- Upd: Flood protection auto-disable in admin/user login
- Fix: False illegal html tags checking in phpbb/bb2nuke Forum preview mode
- Fix: False illegal html tags checking in Private Messages preview mode
- Fix: Corrupt downloaded ban/log files if gz output enabled by server
Very nice, how is the performance? I hear nothing but good about this.
_________________ Paul Laudanski, Microsoft MVP Windows-Security
CastleCops: [de] [en] [wiki]
madman Support Mod
Joined: Feb 15, 2004
Posts: 806
Posted:
Sat May 29, 2004 9:02 am
Zhen-Xjell wrote:
Very nice, how is the performance? I hear nothing but good about this.
Performances are greatly improved since 1.6, and seem no differences in 1.7. But I let users decide whenever their site is a bit slower or not after AS installation.
chevy0 Nuke Cadet
Joined: May 29, 2004
Posts: 4
Posted:
Sat May 29, 2004 10:29 am
how do i make another account god admin?
madman Support Mod
Joined: Feb 15, 2004
Posts: 806
Posted:
Sat May 29, 2004 10:50 am
chevy0 wrote:
how do i make another account god admin?
In Nuke admin menu, you can create another God admin by setting their "realname" as God and their nickname must be differ than another God admins. If Admin Secure installed, as "first" God Admin, you should approve this new account from AS Administration Panel.
chevy0 Nuke Cadet
Joined: May 29, 2004
Posts: 4
Posted:
Sat May 29, 2004 11:01 am
thanks!
and thanks for this nice script ;]
atko Nuke Cadet
Joined: May 27, 2004
Posts: 6
Posted:
Sun May 30, 2004 1:09 am
Looks good. I have Protector installed at the moment. Does this have more features, it does appear so? Also could I install this alongside Protector or is it advisable to have one or the other? Thanks for a great addon and any help appreciated.
foxyfemfem Support Staff
Joined: Jan 23, 2003
Posts: 668
Location: USA
Posted:
Sun May 30, 2004 2:31 am
Hello,
I downloaded the AS from author's website, there was no install.txt file. The only txt file was the readme. I will download it from SourceForge and see if there's an install.txt file. Without this file I am totally lost when it come to installation.
_________________ If you shoot for the moon and miss, you'll still be amongst the stars.
SaraHol Corporal
Joined: Aug 29, 2003
Posts: 71
Posted:
Sun May 30, 2004 2:58 am
A couple of questions:
a) It seems to only support Nuke up to 7.2, and no lower than 6.9? Is that right? My sites are 6.5 and 7.3!
b) Your install.txt (which I found in the zip) states: "At the the top of this script, below the "<?php" (PHP code start tag), add these new lines:". I assume this means AFTER the UTC if you have it installed?
voytas Nuke Cadet
Joined: May 30, 2004
Posts: 2
Posted:
Sun May 30, 2004 4:29 am
i have just installed AS 1.7 and there is problem. i can not enter to forum configuration. there is a blank page.
i use pure phpnuke 7.2.
anythig else seems work great.
madman Support Mod
Joined: Feb 15, 2004
Posts: 806
Posted:
Sun May 30, 2004 10:11 am
Quote:
Looks good. I have Protector installed at the moment. Does this have more features, it does appear so? Also could I install this alongside Protector or is it advisable to have one or the other? Thanks for a great addon and any help appreciated.
Atko, As far as I know and heard, there's no conflicts between Protector System and Admin Secure.
Quote:
I downloaded the AS from author's website, there was no install.txt file. The only txt file was the readme. I will download it from SourceForge and see if there's an install.txt file. Without this file I am totally lost when it come to installation.
Foxy, the install.txt is in the root of archive file, not in the docs directory.
Quote:
It seems to only support Nuke up to 7.2, and no lower than 6.9? Is that right? My sites are 6.5 and 7.3!
Admin Secure support PHP-Nuke 5.5 to 7.2 (7.3 was tested and runs fine, but Admin Secure does not offer tech support this version except for phpnuke clubs, until public version released).
cPortal is based on PHP-Nuke 5.5 and Admin Secure integrated with it. If you currently use PHP-Nuke 6.0 and below, be sure to edit asconfig.php and set $db_compat variable to non-zero.
Quote:
Your install.txt (which I found in the zip) states: "At the the top of this script, below the "<?php" (PHP code start tag), add these new lines:". I assume this means AFTER the UTC if you have it installed?
You can put the inclusion and path detection function either before or after UTC embedded code. This is only an script inclusion code. The actual Admin Secure execution is performed in the last mainfile.php file.
Quote:
i have just installed AS 1.7 and there is problem. i can not enter to forum configuration. there is a blank page. i use pure phpnuke 7.2.
This was a known issue that still has no solution, because only few people got this even compared to other with the same specs (but different server). If you are using phpbb/bb2nuke 2.0.8, open modules/Forums/admin/pagestart.php and try to find this line of code:
if ($cookie[2] == $row2['user_password'] && ($row[radminsuper] == 1 OR $row[radminforum] == 1)) {
Or, if the above doesn't work, replace with:
Code:
if ($row[radminsuper] == 1 OR $row[radminforum] == 1) {
My advice to admins who installing phpbb/bb2nuke 2.0.8, get the latest patch of this mod from NukeCops and be sure to run the table upgrade scripts. I saw many people do upgrading by only copying and overwrites old forum script files without updating database tables. I hope this small solution can solve your problem.
_________________ I'm
phantomk Nuke Soldier
Joined: Apr 28, 2004
Posts: 10
Posted:
Mon May 31, 2004 4:57 am
Luv this mod Madman, Currently useing phpNuke 6.9, with all the security updates I can possibly find, along with Fortress, great tool and best part its small and easy to install, Admin Secure, wonderfull for admin protection, Protector for my main ban magement, and Sentinel for a backup incase anything odd should happen. I have each mod working without any conflictions or problems. Should see about getting together and sorting out one big security addon incorperating each mod into one admin panel with one install. Just a thought.
-PK
Imago Captain
Joined: Jan 17, 2003
Posts: 629
Location: Europe
Posted:
Mon May 31, 2004 6:06 am
I hate Admin Secure as my IP has been banned on several sites when trying to submit news with simple html in them. Now I see only page 404.
May I suggest to not treat HTML as a mallicious code.
I hate Admin Secure as my IP has been banned on several sites when trying to submit news with simple html in them. Now I see only page 404.
Not all html tags are restricted by Admin Secure. For example, text bold <b></b> is still allowed. Tags containing scripting code (or any malicious codes) will trigger security alerts, here some examples:
You'll see how html tags can also exploit your site (e.g. admin auto creation) and your users (e.g. cookie stealing). Html tags can also be used for site defacements or inject your site's visitors with malicious client-side scripting.
When submitting a news, try to keep following site's layout without having to use additional html formatting such as using style tag. I saw some nice "submit news" module replacements which only allow text formatting using bbcode style.
Imago wrote:
May I suggest to not treat HTML as a mallicious code.
It is up to the site admin who using Admin Secure, because html filtering option is adjustable.
_________________ I'm
actingbiz1 Corporal
Joined: May 15, 2004
Posts: 64
Posted:
Wed Jun 09, 2004 12:53 pm
A few questions....
What does this do, how do I install and is it very easy to install?
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
