How to Protect Your Prosper from Attacks ? (14)

It's not hard to find someone's P202 login page.
Do you protect your prosper installation with additional gimmicks ?

You could block access from all IPs other than ones you specify? e.g. with htaccess:

order deny,allow
deny from all
allow from 111.222.333.444

Originally Posted by zeno

You could block access from all IPs other than ones you specify? e.g. with htaccess:

Code:

order deny,allow
deny from all
allow from 111.222.333.444

Not sure if that can cause problems with tracking, but I assume you can block access just at the main directory containing the login page.

<Files 202-login.php>
order deny,allow
deny from all
allow from 127.0.0.1
ErrorDocument 403 http://www.youtube.com/watch?v=bPWVq6MwW4E
</Files>

I used this for awhile: http://stmforum.com/forum/showthread...light=htaccess

Very safe, I found it to be a little bit overdoing it actually as it was a pain to enter two different passwords all the time. The easier solution is renaming the 202-login.php which is mentioned later in the thread I linked above and a strong password that you change regularly. Your mileage may vary though depending on how often you're being attacked and how valuable what you're trying to protect is.

I've personally preferred to just deny every other IP except my own, this way it doesn't matter even if the attacker found out where your login is AND you don't have to enter your info twice to just login to P202.

(+ it's hilarious monitoring your access logs and seeing noobs being redirected to fuck you -videos)

Some servers don't allow .htaccess rewrites, eg. those with mod_rewrite disabled, for these instances you could just modify the 202-login.php to die if the IP doesn't match with the one specified.

In these cases, adding something like:

$ip = $_SERVER['REMOTE_ADDR'];
if($ip != 127.0.0.1) {
die();
}

Yeh I like that method dextrous, less server dependent.

Originally Posted by dextrous

That would destroy the tracking completely if you use it for the whole install, since you are not accepting any traffic from anywhere but your own IP.

You could block just the 202-login.php from being accessed by anyone but you pretty simply; save the following as ".htaccess" and put it to the same directory with your 202-login.php.

Code:

<Files 202-login.php>
order deny,allow
deny from all
allow from 127.0.0.1
ErrorDocument 403 http://www.youtube.com/watch?v=bPWVq6MwW4E
</Files>

Just change 127.0.0.1 to your own IP and the youtube URL to wherever you want the malicious users to redirect

^^

add another line with the ip adress you want to allow access from;

<Files 202-login.php>
order deny,allow
deny from all
allow from 127.0.0.1
allow from xxx.x.x.x ---< IP HERE
ErrorDocument 403 http://www.youtube.com/watch?v=bPWVq6MwW4E
</Files>

If someone would really want access to your prosper though, they could simply hack your server, there is really no real way to secure you prosper/tracking server other then to update all the software packages like PhpMyAdmin/mySQL etc.. frequently. Blocking someone from viewing your /202-login page isn't really securing anything but it will keep some computer newbs out for sure

Assuming your server and important software are up to date, but thats a whole other subject since the thread is about securing the Prosper installation and not the server per se.

^^

Agreed.

But it was just to indicate that online there is no 100% surefire way to secure your stuff.

One single vulnerability on your server side could give the bad guy full access to all the stuff on there.. From there on he/she could find all the data inside of your prosper installation. - Just saying keep your stuff up to date!

Thank you for your trick

who else want to see F**k off video. Just try to log in to my domain

If you have a halfway decent password, what difference does it make if somebody finds your P202 login page?

Sorry for the noob question, just trying to figure out why/if I should bother securing my own P202 installation.

Originally Posted by everest2012

If you have a halfway decent password, what difference does it make if somebody finds your P202 login page?

Sorry for the noob question, just trying to figure out why/if I should bother securing my own P202 installation.

Also, of course, you need to be sure that you're not using your Prosper password anywhere else - otherwise if that other place gets compromised (depressingly common these days) your Prosper install's basically wide open. I can't stress enough how much of a good idea it is to use a password manager like LastPass (not an affiliate link) these days - they'll generate you unique, secure passwords for every site you use and manage them for you.