Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? yes
Have I searched the tickets before posting? yes
Have I read the documentation before posting (which pages?)? yes
Joomla! version: 2.5.6
PHP version:5.2.17
MySQL version: 5.1.63-cll
Host: (optional, but it helps us help you)
Admin Tools version: 2.3.2
Description of my issue:

I was checking the logs last night, and found that someone had made over 700 attempts to login in as admin. All attempts were made from the same IP address and were made within a 5 minute time span. I have manually added the users to the ban list, but isn't this something that AdminTools should catch? How do I configure AdminTools to automatically add the IP to the ban list in a case like this?

Thanks for the superfast response. I am very greatful that I changed the admin user to something other than admin. <sneaky grin> So I was a bit shocked when I saw 600 attempts to login as 'admin'. I just had a couple of follow up questions.

1. Block after x attacks in y minutes. -- What is considered an attack? I don't want to set it so low that someone who just can't rememer their password and is trying several different ones to get banned. What would you recommend. I was thinking of something like 3 in 2 mins.

2. Is there a way to redirect a blocked IP to a "special" page?

.

Thank you Nicholas.

I would like to submit a couple of Feature / Enhancement requests, then.

1. Allow the admin to specify an optional redirect page for anyone IP on the blacklist. I would like to be able to redirect those on the IP blacklist to a specific page, giving them information, and maybe even display a form, giving them oppurtunity requesting that an IP Ban be lifted. It does happen from time to time, someone moves, changes providers, and is assigned an IP that has been already blocked because of the actions of the person who had the IP address before. I ran into that same experience when I recently changed hosting providers, and had to have the IP address removed from the "spammer" lists, because of the person who had the IP address before.

2. I know that I can specify that I want to 'autoban repeat offenders'. I would like a bit more granularity in the the ability to specify how long that IP is blacklisted for. You could even allow for the URL on suggestion 1, to be a default and allow a seperate page to be defined for each level which would override the page defined in my first suggestion. :) You could either allow the admin to add as many as they wanted, or pick a static number between 3 to 5. For Example:

Interval between bans before reset: 3 months
(meaning that if that IP is not banned for 3 months, the previous history is cleared from consideratons.).

1st Ban: 15mins (optional: http://ymydomain.com/youwereabadboy.php)
2nd Ban: 1 day
3rd Ban: 1 week (optional: http://ymydomain.com/youwereaverybadboy.php)
4th Ban: Permament (optional: http://ymydomain.com/youwerearenotwelcome.php)

In any event, thank you for your responses. You can close this ticket, you have given me all the information I need right now. I would have closed it myself, but I wanted to be sure that you saw my suggestions, and was afraid you'd miss them if I closed it.

Thanks Again for your help.
Daniel

Thank you for the indepth explanations.