Account Hacking Protection

Extended Auth Option

Our Elevated-X plugin also offers some optional features that you may or may not enable:

• Smart two-factor-like extended user authentication. If users access your sites from a new location or using a new device, they will be sent a confirmation code by email that they need to copy & paste into a form on your site in order to be able to access AutoGraph-protected video.

  This is useful to eliminate possible account hacking, because hackers who cracked a user's password will always log in from a previously unseen location or unknown device and then fail passing the email code verification, as they have no access to the user's email account.

Prerequisites

• NATS Integration: The extended authentication feature will currently only work if your site's users are managed by NATS. For integration, the NATS REST API must be enabled and an API user with API key must be configured in the cmsinclude.ini.php to allow our script to access your NATS member's database and determine the email address of a particular user. When configuring the NATS API user, please make sure that the user has GET/PATCH permissions on the "member" collection and "details" resource. And you'll need to allow the IP address of your web server where you installed our ping.php script to access the NATS API (the IP must be whitelisted in the NATS security settings under ADMIN_API_ALLOWED_IPS).

• Email Sending Service: While our script can send the emails also locally from your server (if your server is capable of sending out emails), this will likely result in many emails ending up in the recipients' spam folders due to the low sender reputation of your server and is therefore not recommended. For this reason, it is advisable to set up an account with some third-party email sending service and use this for delivering the emails. Our script currently supports the following email sending services (please refer to the documentation of these services on how to set up an account):

  • Mailgun
  • Postmark
  • Amazon SES

Configuration

To enable the "extended authentication" feature, you'll need to set the following options in your cmsinclude.ini.php (some of the options may have already been added during the initial script installation step and are just switched off by default — so make sure you don't add the same config lines a second time).

You'll need to:

• Add xvid_includes.php and ping.php to the [requires] section
• Set POSTPROCESS=xvid_postprocess in the "flags" section
• Set EXTENDED_AUTH_ENABLE_PERCENTAGE and NATS_API_* options in the [xvid] section

cmsinclude.ini.php

[requires]
;require1 = "$_SERVER[DOCUMENT_ROOT]/path/to/include.php"
require2 = "/home/httpd/html/nerds4nerds/public_html/cms_admin/includes/alwaysexec.php"
require3 = "/home/httpd/html/nerds4nerds/public_html/cms_admin/includes/membersMain.class.php"
require4 = "/home/httpd/html/nerds4nerds/public_html/cms_admin/xvid/xvid_includes.php"
require5 = "/home/httpd/html/nerds4nerds/public_html/ping.php"

[flags]
...

POSTPROCESS=xvid_postprocess

[xvid]
...

EXTENDED_AUTH_ENABLE_PERCENTAGE = 100 ; <-- Which percentage of your user-base should have extended auth enabled? Good for a slow, step-by-step role out
EXTENDED_AUTH_RESET_HACKED_PASSWORDS = 1 ; <-- Automatically block an account and force password reset if hacking has been detected?

NATS_API_BASE_URL = "https://join.yoursite.com/api"
NATS_API_KEY = "6bf3456ed18f734ab4c01f25"
NATS_API_USER = "nats_test_user"

MAILGUN_API_KEY = "key-xxxxxxxxxxxxx"
MAILGUN_SENDING_DOMAIN = "mg.yoursite.com"
MAILGUN_SENDER_EMAIL = "Admin <admin@yoursite.com>"

;POSTMARK_SERVER_TOKEN = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
;POSTMARK_SENDER_EMAIL = "Admin <noreply@yoursite.com>"
;POSTMARK_REPLYTO_EMAIL = "support@yoursite.com"

;AMAZON_SES_ACCESS_KEY = "TheAccessKey"
;AMAZON_SES_SECRET_KEY = "TheSecretKey"
;AMAZON_SES_REGION = "us-east-1"
;AMAZON_SES_SENDER_EMAIL = "Admin <admin@yoursite.com>"
;AMAZON_SES_REPLYTO_EMAIL = "support@yoursite.com"