Active InfoActive Info  Display List of Info MembersMemberlist  Search The InfoSearch  HelpHelp
  RegisterRegister  LoginLogin
Application Requests & Ideas
 CJWSoft Support Info : Application Requests & Ideas
Subject Info: login abuse ASPProtect A d d  -  P o s tAdd P o s t
Author
Message << Prev Info | Next Info >>
dazedconfused
New User
New User
Avatar

Joined: April/11/2004
Location: United States
Online Status: Offline
Info: 17
Added: January/23/2006 at 5:25am | IP Logged Quote dazedconfused

((TITLE EDITED BY ADMIN))


it would be nice if there was an option for login abuse, where a login account would be flagged if it logged in from x number of different IPs over a period of time. I know many have dynamic IPs, but there's got to be a balance between legitimate logins and logins that are 'shared' for the sake of saving money (I sell subscriptions), in the end costing me.

Maybe searching the first two number groups in the IP (example, 209.168.*.*), and if finding more than an admin specified number of logins per week from IPs with different first two groups, the record would be flagged or locked...

 

Back to Top View dazedconfused's Profile Search for other info by dazedconfused
 
cwilliams
Admin Group
Admin Group
Avatar
CJWSoft Web Software Developer

Joined: April/06/2004
Online Status: Offline
Info: 1769
Added: January/23/2006 at 10:30am | IP Logged Quote cwilliams

What application you talking about ? I'll assume ASPProtect. In the future please specify what application you are talking about.

ASPProtect 7 already has protection that is quite effective. The no concurrent login feature which will not let the same username under a different ip log in at the same time. Meaning if someone gives out their info they will screw themslves over because eventually they won't be able to log in. Only one unique ip at a time can log in so even of 100 people know the info it won't really do anyone much good except the lucky one that logged in 1st and stayed logged in.  The username/password will eventually become more and more useless as more and people know it.

In addition to that is is a good idea to monitor the daily logs and single out a user you see logging in a lot. The more ips you see for that user the more chance it is multiple people logging in and you should take action.

__________________

Best Regards, Christopher Williams www.CJWSoft.com
Back to Top View cwilliams's Profile Search for other info by cwilliams Visit cwilliams's Homepage
 
dazedconfused
New User
New User
Avatar

Joined: April/11/2004
Location: United States
Online Status: Offline
Info: 17
Added: January/23/2006 at 11:40am | IP Logged Quote dazedconfused

Yes, I was referring to ASP Protect.

I had about a dozen people access the same account, but it is highly unlikely that they would all try at the same time (unless there were several hundred people who had access). Having an enhanced login abuse would be nice.

 

Back to Top View dazedconfused's Profile Search for other info by dazedconfused
 
cwilliams
Admin Group
Admin Group
Avatar
CJWSoft Web Software Developer

Joined: April/06/2004
Online Status: Offline
Info: 1769
Added: January/23/2006 at 11:49am | IP Logged Quote cwilliams

well, for now you have to watch the logs. What your talking about would take up a lot of server resources and database space to keep track of. Maybe some day, but no plans at the moment.

__________________

Best Regards, Christopher Williams www.CJWSoft.com
Back to Top View cwilliams's Profile Search for other info by cwilliams Visit cwilliams's Homepage
 
dazedconfused
New User
New User
Avatar

Joined: April/11/2004
Location: United States
Online Status: Offline
Info: 17
Added: January/23/2006 at 12:06pm | IP Logged Quote dazedconfused

i will probably end up doing this myself, but dropping all the log data in a sql table would be nice as it offers much more flexibility on how an admin can keep track and use the data. Browsing through each log file is very inconvenient. I can search for text in the files (server-side, others with a shared server would probably have to separately download all log files first), but with the current method I don't have the following important options:

  • cannot sort by any criteria
  • quickly see a list of all login attempts by a specific user (i need to search each log file individually for this info)

if you had an option during setup perhaps (or elsewhere) in a future version that allowed an admin to specify the preferred logging method (separate files or a table in sql) i'm sure many admins would find it very useful to have a database alternative of keeping track of users becuase it would offer the two benefits listed above, plus more.

Back to Top View dazedconfused's Profile Search for other info by dazedconfused
 
cwilliams
Admin Group
Admin Group
Avatar
CJWSoft Web Software Developer

Joined: April/06/2004
Online Status: Offline
Info: 1769
Added: January/23/2006 at 12:11pm | IP Logged Quote cwilliams

Thanks, I know, I have it all figured out and have thought about it before. Just no time yet to do it.  It will probably be an add-on/mod when I get time.

__________________

Best Regards, Christopher Williams www.CJWSoft.com
Back to Top View cwilliams's Profile Search for other info by cwilliams Visit cwilliams's Homepage
 
dazedconfused
New User
New User
Avatar

Joined: April/11/2004
Location: United States
Online Status: Offline
Info: 17
Added: January/26/2006 at 10:59pm | IP Logged Quote dazedconfused

A mod like this would improve tracking by leaps and bounds.

Do you think this addon would be availalbe anytime in the near future? If/when this feature or mod becomes availalbe, it certainly would be ideal if some script was made to import all the log file data.

Back to Top View dazedconfused's Profile Search for other info by dazedconfused
 
cwilliams
Admin Group
Admin Group
Avatar
CJWSoft Web Software Developer

Joined: April/06/2004
Online Status: Offline
Info: 1769
Added: January/27/2006 at 4:21am | IP Logged Quote cwilliams

Sorry, I can not provide a date..  I am last person that is organized enough to give any sort of release date on anything.

Could be next week, could be 2 years from now. I made two add-ons this week and they came out of no where. I had no plans to make them. etc etc.. they just happened.

If I told you 2 months from now I know it would not be done and you would be disappopinted so I am not saying anything. I will say if it turns out to be anything complex it will not be a free mod or it will be a feature of a new version.

__________________

Best Regards, Christopher Williams www.CJWSoft.com
Back to Top View cwilliams's Profile Search for other info by cwilliams Visit cwilliams's Homepage
 
cwilliams
Admin Group
Admin Group
Avatar
CJWSoft Web Software Developer

Joined: April/06/2004
Online Status: Offline
Info: 1769
Added: November/18/2007 at 4:50pm | IP Logged Quote cwilliams

And version 8 released yesterday now comes with Database Logging as a feature..

__________________

Best Regards, Christopher Williams www.CJWSoft.com
Back to Top View cwilliams's Profile Search for other info by cwilliams Visit cwilliams's Homepage
 
tbirrd
New User
New User
Avatar

Joined: March/30/2008
Location: United States
Online Status: Offline
Info: 1
Added: March/30/2008 at 9:29pm | IP Logged Quote tbirrd

Hello my name is Tony and I'm a new member and i just started to work with ASP 2,0 is what my server will except. i just want a simple hit counter on my webpage, but i just don't know how to get it to work. I know that they say that you have to have a directory, and then  put some files into it but i don't know which files goes in it. Could someone help me out explaining step by step as far as putting what files in the note-pad, and what files go to the server side and what directory i need and where to put everything. as i said i'm new at this but once i understand this i will have the knowledge on how to do this from here on out. Just a smiple hit counter with green numbers. thats all that i need.

 

Thanks,

Tony D.



__________________
Tony D. DeValt
Back to Top View tbirrd's Profile Search for other info by tbirrd Visit tbirrd's Homepage
 
cwilliams
Admin Group
Admin Group
Avatar
CJWSoft Web Software Developer

Joined: April/06/2004
Online Status: Offline
Info: 1769
Added: March/30/2008 at 9:37pm | IP Logged Quote cwilliams

These forums are for questions regarding CJW SOFTWARE products only.

You don't appear to be asking a question regarding a CJWSoft product so I really don't understand why you posted this here?
 

 



__________________

Best Regards, Christopher Williams www.CJWSoft.com
Back to Top View cwilliams's Profile Search for other info by cwilliams Visit cwilliams's Homepage
 

If you wish to make a comment to this info you must first login
If you are not already registered you must first register

  A d d  -  P o s tAdd P o s t
Printable version Printable version

Info Jump
You cannot add new info in this area
You cannot add to info in this area
You cannot delete your info in this area
You cannot edit your info in this area
You cannot create polls in this area
You cannot vote in polls in this area


Active Server Pages ASP control controls class classes module script Scripts applet CJWSoft ASPProtect ASPBanner ASPClassifieds www.aspprotect.com, www.powerasp.com,www.aspclassifieds.com,www.aspphotogallery.com,www.codewanker.com