Banning a user from accessing Admin Panel Login

[[email protected]]

So I am fairly certain someone has gotten my IP address and is using a VPN to change their IP to my IP when they access my forum and are trying to log into my Admin Panel. When I go to see who is online, I see my IP address as a 'Guest', and this 'Guest' and is on the Admin Login page viewing the 'No Permissions' message. What is the best course of action to take here, seeing as I cant ban this IP since I will ban myself in the process ? I have already changed the PW. Any and all advice here is appreciated.

This is for Vbulletin 4

[In Omnibus]

Change the directory names of the admincp and modcp folders and then change the routes for each in the config.php file.

/* #### PATH TO ADMIN & MODERATOR CONTROL PANELS ####
This setting allows you to change the name of the folders that the admin and
moderator control panels reside in. You may wish to do this for security purposes.
Please note that if you change the name of the directory here, you will still need
to manually change the name of the directory on the server. */
$config['Misc']['admincpdir'] = 'admincp';
$config['Misc']['modcpdir'] = 'modcp';

Give the URLs to anyone who should have them but do not post or link to them anywhere on the website.

You may also want to password protect those folders from your cPanel or other hosting platform.

[[email protected]]

Thanks for your response. I will have this taken care of. Can you suggest any other measures, in general, for defense against whatever the contemporary methods are, for vbulletin forum hacking

[Mark.B]

You are almost certainly seeing yourself viewing the admin login screen immediately prior to logging in.

Practically everything people think is 'hackers personally attacking and destroying my site' is actually perfectly innocent behaviour. There simply isn't an army of evil hackers sat at a computer trying to figure out ways of attacking your site. These thoughts are understandable, but are caused by constant media hysteria on the subject.

Changing the name of the admincp folder offers absolutely no additional security whatsoever, (if someone actually gained access to your site, it would take them less than five seconds to find the renamed admincp) and indeed the functionality was removed in vBulletin 5, where instead you have useful security available, such as two factor authentication.In vB4 though you can add an IP check and an additional .htaccess password to the admincp using an .htaccess file. Some server control panels will do the latter for you, for example cPanel has "password protect directories" which does the same thing.

[djbaxter]

^^ What Mark.B said. You are worrying about nothing and taking extraordinary measures like using a "secret" admin directory is just a PITA that won't solve anything.

[[email protected]]

To address what you both said, I had a falling out with someone who has the means and capabilities to do exactly what I stated. On top of that, he mentioned his plan to an acquaintance of mine. It is an actual threat. I am not some moron who is over paranoid. I would like your expert opinions, as a vb license holder.

[Wayne Luke]

To address what you both said, I had a falling out with someone who has the means and capabilities to do exactly what I stated. On top of that, he mentioned his plan to an acquaintance of mine. It is an actual threat. I am not some moron who is over paranoid. I would like your expert opinions, as a vb license holder.

Use a strong password or upgrade to vBulletin 5 and use two-factor authorization.

You also shouldn't use your email address as a username on forums.

[[email protected]]

Thank you Wayne. And yes, I have been attempting to change my username but havent been able to find out exactly how. Can anyone provide some insight on accomplishing that ?

[Mark.B]

Thank you Wayne. And yes, I have been attempting to change my username but havent been able to find out exactly how. Can anyone provide some insight on accomplishing that ?

A support ticket is probably the best way to achieve that.

By the way - to address something you said earlier - nobody thinks you're a 'moron' . Just felt I ought to clear that up.