e107plugins.co.uk

PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application. The IDS neither strips, sanitizes nor filters any malicious input, it simply recognizes when an attacker tries to break your site and reacts in exactly the way you want it to. Based on a set of approved and heavily tested filter rules any attack is given a numerical impact rating which makes it easy to decide what kind of action should follow the hacking attempt. This could range from simple logging to sending out an emergency mail to the development team, displaying a warning message for the attacker or even ending the user’s session. PHPIDS enables you to see who’s attacking your site and how and all without the tedious trawling of logfiles or searching hacker forums for your domain. Last but not least it’s licensed under the LGPL!

http://php-ids.org/

I have now uploaded a new plugin.

It is the BETA version of a plugin i have had sitting around for a while
called File Fingerprint Maker, its a plugin for auditing and verifying files within
your web structure.

"I got the idea from tripwire, thought i create an E107 plugin that does a similar thing".

It will audit a directory by collecting a list of all included files and then record there
File Name, location, size, date of audit, MD5 File hash, SHA1 File hash, size, permissions,
owner and group.

Any additional audits done on a directory will have there results compared with the ones received previously.

Therefore the File Fingerprint Maker can tell you when.

• A new file is created
• A files size changes
• A files permissions changes
• A files data contents canges
• A files owner changes
• A file is Deleted

Only changes to the original audit will be recorded and these will be listed in the log viewer.

The log viewer can be used to check the entire history of a file or a list of all new files added to the system or all files with specific permissions, etc.

The log viewer can also be used to provide you with the MD5 and SHA1 Hashes for your plugins and files and let you know if they have been tampered with.

Regular auditing can be done either by the use of a menu or by a cron job / scheduled task.

Be warned the more files you audit the longer the process will take and the more results will be recorded in you DB "so start with small directories".

As i have already said this will be BETA! .

DO NOT USE ON PRODUCTION SYSTEMS, UNLESS YOU ARE HAPPY WITH IT

I use this myself on this site for validating my plugins and creting the MD5 and SHA1 hashes for them.