Hack Forums
[MyBB] [Tutorial] Protecting your forum - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Webmasters (https://hackforums.net/forumdisplay.php?fid=141)
+---- Forum: Website Construction (https://hackforums.net/forumdisplay.php?fid=50)
+---- Thread: [MyBB] [Tutorial] Protecting your forum (/showthread.php?tid=4749546)

Pages: Pages 1 2

[Tutorial] Protecting your forum - Private Network - Mar 27, 2015

Information: http://community.mybb.com/thread-44977.html
Extra Secure: http://community.mybb.com/thread-131553.html

MyBB is ofcourse very secure, but it can still be hacked because of laziness...

This will teach you BASIC MyBB protection.

1. Admin Directory

Anyone should know that it is very important to rename the administator directory...
If they can't find it how should they hack it.

Go to your filehost and then find the folder called "admin" and change the name to something else not obvious like "administrator"...

Then, search for the config.php file in the "inc" directory.
Look for this code:

Code
/**
* Admin CP directory
* For security reasons, it is recommended you
* rename your Admin CP directory. You then need
* to adjust the value below to point to the
* new directory.
*/

$config['admin_dir'] = 'admin';

And change the 'admin' part to the name you changed the directory to.

2. .htaccess
Renaming the directory is not enough to fully stop it.
This code will check the users IP that is trying to acces the admin page.

Create a .htaccess file in your administrator folder and add this code:
Code
RewriteEngine On
RewriteBase /
RewriteCond %{REMOTE_HOST} !^12\.345\.678\.9
RewriteRule .* http://www.mybbwebhost.com [R=301,L]

Change the "12\.345\.678\.9" to your IP address with the format and change the "http://www.mybbwebhost.com" to the URL you want them to be redirected.

If you have more admin's then add this code instead:
Code
ErrorDocument 403 http://www.mybbwebhost.com
Order deny,allow
Deny from all
Allow from 123.45.67.899
Allow from 998.76.54.321

Change the "123.45.67.899" and "998.76.54.321" to your IP addresses, if you have more add more lines.
And ofcourse change the "http://www.mybbwebhost.com" to the URL you want them to be redirected.

3. Deny externall config access

Create a .htacces file in your "inc" folder and add this code:
Code
<files config.php>
Order deny,allow
deny from all
</files>

This will deny any EXTERNALL access, the forums will still run normally.

* - AMC. - Mar 27, 2015

Good tutorial, You could also do things like password protecting your admin directory

* - Comedic - Mar 27, 2015

Very nice tutorial my friend, how long did it take you to write all this?

* - Private Network - Mar 28, 2015

(Mar 27, 2015 08:55 PM)Comedic Wrote:  Very nice tutorial my friend, how long did it take you to write all this?

Around 45 minutes, I just like MyBB but its horrible how so many forums get hacked easily...

It's not the softwares fault but mostly the owner's.

* - ThorAndOdin - Mar 28, 2015

This should help a lot of new MyBB forums as i know there are quite a few exploits that are easily able to use on new forums or even some older forums if the owners are unaware of how to defend against them.

* - Private Network - Mar 28, 2015

(Mar 28, 2015 12:56 AM)ThorAndOdin Wrote:  This should help a lot of new MyBB forums as i know there are quite a few exploits that are easily able to use on new forums or even some older forums if the owners are unaware of how to defend against them.

Yes, you should also look if you have any plugins that are exploitable.

* - Hуѕтєяιa X™ - Mar 28, 2015

Nice guide. This one has some extra points as well, for a read.
http://community.mybb.com/thread-131553.html

* - Michael - Mar 28, 2015

Giving credits to the original author would be nice.
http://community.mybb.com/thread-44977.html

OT: Still useful you post this, so other members can secure their forums.

* - ZuGgY - Mar 28, 2015

Pretty helpful for a lot of newbie board owners out there.
Good post.

* - Private Network - Mar 28, 2015

(Mar 28, 2015 06:40 AM)Μichael Wrote:  Giving credits to the original author would be nice.
http://community.mybb.com/thread-44977.html

OT: Still useful you post this, so other members can secure their forums.

Its from there, but I worded it myself and did not just copy and paste.

Will add these 2 posts to the main thread!

* - Kogan - Apr 10, 2015

This is an excellent tutorial if you're hosting your forum on shared hosting. If you're hosting on a VPS/VDS or a dedicated node, it would get a lot more complex.

Great tut.

* - Private Network - Apr 10, 2015

(Apr 10, 2015 08:40 AM)Kogan Wrote:  This is an excellent tutorial if you're hosting your forum on shared hosting. If you're hosting on a VPS/VDS or a dedicated node, it would get a lot more complex.

Great tut.

Yeah, these are only the basic things.

Thanks a lot!

* - PsykD - Apr 10, 2015

This is a good tutorial. Thank you for sharing this!

* - Private Network - Apr 10, 2015

(Apr 10, 2015 09:18 AM)PsykD Wrote:  This is a good tutorial. Thank you for sharing this!

Thanks a lot for your feedback, PsykD!

* - CJamie - Apr 10, 2015

Pretty helpful for a lot of newbie board owners out there.
Good post.