LoginSecurity 1.2.1

[Lyphiard]

Lyphiard submitted a new resource:

LoginSecurity - Log all user and admin login attempts!

This addon will provide the ability for you to record all login attempts for all users, as well as for administrators. The addon will record information such as the IP address the attempt was made from, the time of the attempt, whether the attempt was successful or not, whether 2FA was required or not, and whether 2FA was successful or not.

Features:

• Users will be able to see their own login attempts under "Login Security"
• Users have the option of being emailed when they login...

Read more about this resource...

 

[Lyphiard]

Lyphiard updated LoginSecurity with a new update entry:

New Features

• Added permissions for whether or not a user is able to view their login history
• Disabled displaying the 2FA column on forums running XenForo versions lower than 1.5.0
• Added the option for administrators to configure the number of rows of login attempts a user can see

Read the rest of this update entry...

 

[Lyphiard]

Lyphiard updated LoginSecurity with a new update entry:

FileSums & Automated Removal

• Added the proper hashes for XenForo's file health check
• Added a cron job to delete old login entries (configurable)

Read the rest of this update entry...

 

[Finexes]

Is there any possibility to translate the email text?

 

[Lyphiard]

Lyphiard updated LoginSecurity with a new update entry:

Email Template Phrases

• Changed email template to use phrases instead of normal text

Read the rest of this update entry...

 

[Lyphiard]

Is there any possibility to translate the email text?

I've added the phrases "lsec_login_from_new_ip", "lsec_new_login_attempt", and "lsec_user_agent", which should be used in the email template.

 

[Mouth]

Users can opt to receive an e-mail when they log in with a new IP. This is by default on.

Any chance this can be off by default? I don't want users to start receiving emails automatically everytime they logon between desktop and mobile.

 

[Lyphiard]

Lyphiard updated LoginSecurity with a new update entry:

Notify New IP Default Setting

• Added the option to change the default setting for new user registrations. Any existing users will not be affected.

Read the rest of this update entry...

 

[Lyphiard]

Any chance this can be off by default? I don't want users to start receiving emails automatically everytime they logon between desktop and mobile.

I've added a new option in ACP, but you'll need to modify the column lsec_notify_new_ip in the table xf_user_option for any existing users.

 

[Finexes]

I've added the phrases "lsec_login_from_new_ip", "lsec_new_login_attempt", and "lsec_user_agent", which should be used in the email template.

Wow, that was fast! Thank you very much

 

[tjrgg]

Hey @Lyphiard,

Love this addon. Great job on it!

One thing I would love to see is the ability to give staff members (aka moderators) the ability to see the last X number of login attempts on any particular user from the frontend. For my particular community, the administrator control panel is limited to myself and one other person, but I'd love to be able to give some staff members the ability to see this from the frontend. A couple of ways this could be accomplished is through a tab on each user's profile or some user lookup page within a moderator's account, similar to Moderator Essentials' IP lookup feature.

As is though, it's a great addon. Thanks for taking the time to develop it and put it out there.

 

[Lyphiard]

Lyphiard updated LoginSecurity with a new update entry:

View Login Attempts in Member Profile

• Added the ability to view a member's login attempts in their profile. Requires the general moderator permission "View all login attempts".

Read the rest of this update entry...

 

[Lyphiard]

Lyphiard updated LoginSecurity with a new update entry:

GeoIP & ACP Login Alerts

• Enabled the use of GeoIP in order to display the approximate location of a login. This can be enabled through ACP. (Note: You must have php-geoip installed for this to function properly)
• Added the ability to notify certain users of all successful ACP login attempts. This can be enabled and configured through ACP.

Read the rest of this update entry...

 

[pecadm]

Hey @Lyphiard ,

Great addon, thank you very much.

Would it be possible to add an IP whitelist option for the users ?
A lot of our users (including me ) are constantly switching between the same networks (home, office etc.), but do not want to deactivate the email option for security reasons. Would be great if there was an option set some "trusted IPs" per user.

 

[Lyphiard]

Hey @Lyphiard ,

Great addon, thank you very much.

Would it be possible to add an IP whitelist option for the users ?
A lot of our users (including me ) are constantly switching between the same networks (home, office etc.), but do not want to deactivate the email option for security reasons. Would be great if there was an option set some "trusted IPs" per user.

Do you mean for ACP logins?

 

[Onlyme]

Nice addon thank you. I'm a right saying that it doesn't notify users of failed login attempt or notify selected admins of failed control panel attempts?

 

[Lyphiard]

Nice addon thank you. I'm a right saying that it doesn't notify users of failed login attempt or notify selected admins of failed control panel attempts?

No, it currently does not. If someone decides to try to log into 100 admin accounts, I don't think it would be wise to send out 100 email notifications.

I might add a future feature where it will send a notification to certain people if there were X failed admin login attempts within the last Y minutes.

 

[Onlyme]

No, it currently does not. If someone decides to try to log into 100 admin accounts, I don't think it would be wise to send out 100 email notifications.

I might add a future feature where it will send a notification to certain people if there were X failed admin login attempts within the last Y minutes.

You could add ban IP feature after 5 attempts. Include a user whitelist tho

 

[pecadm]

Do you mean for ACP logins?

ACP would also be ok, but for users would be more important.

 

[Lyphiard]

ACP would also be ok, but for users would be more important.

It's only going to email users if their logging on with a new IP that they never ever used before, so they will only receive one IP per email, ever.