Administrating MyBB - good practices

[Dennis Tsang]

As long as it contains the Powered by MyBB and copyright, and a link to http://www.mybboard.com, it is fine.

[EGS]

If you really wanted to protect the admin directory there's not really a need to change the name, just password protect it using .htaccess so it's double the protection...kind of like a Trojan Enhanced Pleasure Condom.

[Dennis Tsang]

Why not change name, .htaccess, and a complex password?

If you leave your admin directory as /admin/ that doesn't prevent people from attempting to brute force your username/password.

[destroyer]

Galen Wrote:Another good idea is to never use the default database prefix (mybb_). The scripts used by script kiddies to make database changes assume that the default prefix is in use.

How can the prefixes be changed?

[destroyer]

CraKteR Wrote:If you really wanna be sure that people cannot see the current version number.
go to admin/admin_functions.php
find:

Code:

echo "<font size=\"1\" face=\"Verdana,Arial,Helvetica\">".$lang->footer_powered_by." <b>MyBB $mybboard[internalver]</b><br>".$lang->footer_copyright." &copy; 2005 MyBB Group<br />".$lang->footer_stats."</font></center>\n";

change it to.

Code:

echo "<font size=\"1\" face=\"Verdana,Arial,Helvetica\">".$lang->footer_powered_by." <b>MyBB</b><br>".$lang->footer_copyright." &copy; 2005 MyBB Group<br />".$lang->footer_stats."</font></center>\n";

admin_functions.php is an invision powerdboard file on my ftp. Wtf O.O
I never used that board, however the mybb is working fine.

[destroyer]

Galen Wrote:I've said it before and I'll say it again. Take a screen cap of your board's copyright. Open the screen cap and crop it down so that it's just a pic of the copyright. Now, replace the default text copyright with that image. This prevents script kiddies from finding your site by googling "Powered by MyBB" but it still leaves the copyright in tact for all to see.

I should note that I have not gotten an official answer on whether or not it's "Ok" to do this. I would think so, though, and unless Chris or someone else with MyBB Group specifically says "don't do that" then I'm going to keep doing it and I recommend that the rest of you do it as well.

Can you help me doing this?

[Martin M.]

destroyer Wrote:admin_functions.php is an invision powerdboard file on my ftp. Wtf O.O
I never used that board, however the mybb is working fine.

What do you mean by that?
edit, changed it to right now.

[destroyer]

Lol, I don't know how it got there.

[IMPAQ]

destroyer Wrote:admin_functions.php is an invision powerdboard file on my ftp. Wtf O.O
I never used that board, however the mybb is working fine.

That happened on one of my forums before. Wierd!

Anyways... thanks for this tutorial, guys! We had 3 hacking attempts through two different sites and implemented these changes with ease to help prevent such a thing from happening once again.

[destroyer]

Invision hacked the mybb board package to include their files. Lol