Question about Security

[MewDragon]

Hey guys,

I'm debating on what type of security mods I should install on my phpbb forum. The two big ones, I think anyway, that I was considering installing are these:

http://phpbbhacks.com/download/4359

http://phpbb-tweaks.com/topics.html-t-665

Would someone be able to advise me which one is better, or if there's something else I should be installing instead, thanks, I appreciate the assist.

[Saeru]

I would not bother with security mods, as long as your forum is kept up to date you wont be hacked. There has not been a signle real report of hacking the newer versions of the forums.

Security mods May have their own security issues and may leave back doors into your forum, plus most are made for the older versions that did have some security issues.

Just keep your forum up to date.

[Ash Hi Fi Zone]

Hmm I too would not advise on using those MODS....If you want some security adding a .htaccess and .htpasswd file to your admin directory should do well.... Also there is a mod called User Protect MOD which automatically locks anyone's account temporarily for 30 mins or so if more than 3 failed login attempts is achieved....

[drathbun]

[Ash Hi Fi Zone]

But the USER PROTECT MOD also logs the IP of the failed login attempt which may come useful at time to detect who was that mutt who tried to login to another member's account.... The default phpBB lcoking thing does not have that option doesnt it ?

Also userprotect MOD allows you to specify some restrictions on length of password and some more password related features too... The blocking time is also easily configurable....

[Saeru]

If you want an IP log then thats one thung. But there is no need to add in any ofthe security mods that are out.

[Ash Hi Fi Zone]

Yep - another security measure you can take is to use a different prefix for your tables in your DB

[MewDragon]

Ah, really? Allright then. I have a lot of mods installed on my forum though, which I guess increases the number of potential exploits. Should I still not bother with it then?

[Ash Hi Fi Zone]

Well actually if the installed MODS are approved in the phpbb MOD-DB I 'm pretty sure there is not much chances of any security exploits......

So if you want the IP logger alone for failed login attempts you can install that mod and also use htaccess protection for admin folder.... That should pretty much be enough

[igorw]

Yeah, MODs from phpBB.com's MODDB are pretty secure