MyBB Community Forums

Information:
This plugin forces moderators to log in in again in order to use the Mod CP. It stores these sessions in a table so they can be looked up later in the Admin CP. While all administrators can view the sessions, only a super admin can either forcefully disconnect the session or make it so that moderator is unable to log into the Mod CP.

If two or more users are logged in simultaneously with the same username in the Mod CP, all users logged in with that username are logged out of the Mod CP.

It also creates up to two new security features for logging into the Admin CP that can make it virtually impossible to get in. These features are having a private key system that checks the content of the key. The second is where it actually verifies the name of the file against the configuration file. For configuration details, please refer to the Read Me file in the download.

Installation
1) Upload advanced_security.php to your inc/plugins directory.
2) Upload modcp_sessions.php to your admin/modules/tools directory.
3) Upload index.php to your admin directory replacing the default file.
4) Upload class_page.php to your admin/inc directory replacing the default file.
5) Install the plugin from the Admin CP.
6) Do any configuration for Admin CP logins.

Current Version: 1.0

Support
If you need help configuring the plugin after reading the Read Me file, please post and I will respond as soon as I have a chance. Your forum must also be eligible for support or help will not be given.

Download Link: http://mods.mybb.com/view/advanced-security

Suggestions or comments are welcome.

Good stuff, will use. Thanks!

Does anyone have any suggestions to add to this plugin since I plan on making it work for 1.8?

(2014-07-01, 10:38 PM)dragonexpert Wrote: [ -> ]Does anyone have any suggestions to add to this plugin since I plan on making it work for 1.8?

YubiKey support

Could you explain what that is please? Also possibly a link preferably with documentation.

A YubiKey is a key-sized device that you can plug into your computer’s USB slot to provide another layer of security.

http://www.yubico.com/products/yubikey-hardware/
https://github.com/Yubico

Rather than Yubikey, why not just standard TOTP, that way people can use any mobile phone with Authy/Google Authenticator/whatever other apps provide it.

PHP library: https://github.com/lelag/otphp

BTW, I think it's better to use PluginLibrary's edit_core() function rather than uploading whole core files which may differ in any MyBB version. http://community.mybb.com/thread-87399.html

(2014-07-01, 10:38 PM)dragonexpert Wrote: [ -> ]Does anyone have any suggestions to add to this plugin since I plan on making it work for 1.8?

2 Step Verification for Admin CP? I think 2 Step Verification for Mod CP would be overkill.

It looks like there are some new hooks in the admin files so I might be able to use them now instead of doing a core edit. When I have time to investigate that, I'll update it.