We are very happy with the older version of Strongbox that is running on FoxyAngel.com. I noticed the other day that the newer version of Strongbox that is running on KatVixen.com now works properly with Mac's Safari and also has a passphase option for using on the member's login page. :)

The only thing I can think of that I would change is have a way to turn on/off the email function, on a normal day it's not bad, but the bad days where I get 4500+ emails in 6 hours time takes forever to download and it's always at the worst times.

But I will deal with that over have brute force attacks and all the other crap any day, I defiantly recommend Strongbox.

You should be able to comment out this line
$disabto="webmaster\@$host";
in the config.pl file to stop the mail.

Personally I like fucking with the password trading sites. :D

You can and need to turn off the email stuff. Before I turned it off I would get 500 to 1,000 an hour when people were poking.

The feature that I want/need is to have the admin work for ALL sites on a server. Right now it's one site at a time.

The product DOES work just fine.

I have recommended Strongbox to a lot of my hosting clients and every one of them that took it up was very impressed by its capabilities. Plus Ray is a good guy, I enjoy working with him.

cheers,
Luke

|bow| RAY ROCKS! And I still think he doesn't charge near enough money for this product. Sorry guys.....just being honest.

|pink |pink |pink

Thanks for the very kind posts. There are a couple
of different variables that can be set to adjust the
number of emails Strongbox sends. Below is a cut and
paste from the new Owner's manual page
describing these options, which can be found
at:
http://www.bettercgi.com/strongbox/manual/emails.html

Linda mentioned that she thinks I don't charge enough.
Several other people have said the same thing.
In fact, after I get another support person trained,
the owner's manual "completed", and some
admin interface improvements done I do plan
to increase the price to $150, so if you're planning
to put Strongbox on some more sites you may
wish to order in the next couple of weeks before
I complete these items and then feel comfortable
increasing the price.

Strongbox Owner's Manual - Notification Emails

Strongbox will send emails to your specified email address(es)
when it detects certain types of unusual activity.
There are 3 variables in cgi-bin/sblogin/config.pl which
affect this behavior. Some webmasters with many busy sites
or sites which are the target of many attacks prefer to
recieve fewer emails, being notified of only the most important
information. These variables start at about line #55
of the config file.

@email_addresses (aka @disabtos)

The first sets which email addresses
should be notified. On oler installations this variable
was called @disabtos. On newer installations it has a better
name, @email_addresses. It looks like:

        @disabtos             = ( 'you@yoursite.com', 'tech@yoursite.com' );

        or:

        @email_addresses      = ( 'you@yoursite.com', 'tech@yoursite.com' );

        

This is a comma seperated list of email addresses, all of which
will recieve identical emails when Strongbox needs to notify you
of something. You can have as many email addresses listed as you
wish, from none at all to many. Note that the last email address
does not have a comma after it.

$notifyof

The $notifyof variable tells Strongbox which conditions it should email
you about. If you find that you are recieving more emails than you
would like this is one variable you may wish to edit. This is a list of
"result codes" that match the result codes shown in the Strongbox reports
and the result code which is found in the emails as the last word in
the subject line of the email. It looks like this:

       $notifyof             = 'htpffail|opnproxy|attempts|dis_uniq|totllgns|uniqsubs|badchars|uniqcnty';

       

Some webmasters that get a lot of proxy based dictionary attacks end
up recieving a lot of emails about people trying to login via open proxies,
status code "opnproxy", so they choose not be be notified each time this
happens, but have Strongbox wait to notify them until it suspends a
username of password. To adjust this you can just remove "opnproxy"
from the list, so it looks like this:

       $notifyof             = 'htpffail|attempts|dis_uniq|totllgns|uniqsubs|badchars|uniqcnty';

       

Even if you remove all of the others, you'll probably want to keep
htpffail, which tells you if Strongbox is unable to read the password
file (meaning it probably got deleted or moved), and dis_uniq, which
tells you when a username is permanently disabled. See the
status codes
page for a description of all of the possible status codes.

$max_notices_per_day

Sites which had Strongbox installed after mid 2005 will have
a 3rd variable as the next line after $notifyof, called $max_notices_per_day.
This tell Strongbox the maximum number of emails it should send in
a single day. It looks like:

      $max_notices_per_day  = 25;

      

You can change the maximum number to any number, from zero to any very large nymber.

$notifyof = 'htpffail|attempts|dis_uniq|totllgns|uniqsubs|badchars|uniqcnty';

This looks to be what I am wanting, thanks Cleo and Raymor and whoever else gave me the code to look for.

|thumb

ok, I edited it... now I wait and see if I mucked it up ;)

FYI I just created a Strongbox forum:
http://www.bettercgi.com/forum/

I tried to change something by editing and I really SCREWED IT UP. As always, Ray came to the rescue and undid the mess I created. (I never claimed to know what I was doing when it comes to any codes and such). |huh Good luck to you!

Go Ray....! |pink

nice Ray. hey, i've been trying to contact you on icq "ATCI_Chris" for the past few weeks but you haven't responde at all. is everything ok? vacation?

I'm not using ICQ any more.
I'll give you a call.

nah, don't worry about it. we had a customer with some issues that i think we got straightened out. lol, you still using email?

good to hear everything is ok.

After hearing the good things about Strongbox, and talking to Ray on the phone, I just put in my order. I'm especially looking forward to the anti-sluping features. That in itself is worth the price! Hope you don't have any probs with the hurricane Ray!

THanks for your comments, koolcat.
I'm doing the pre-installation checks on your
site right now and am going to try to finish
up all of the pending orders tomorrow before
the power goes out. We will probably lose power here
and while I have back up batteries and a generator
(actually an alternator) to power my office, I expect the
cable internet will probably go out.
If you all don't hear from me for a couple days
it's probably because the internet is out so I've left the office
to go help take care of some of the evacuees who are here.

You will NEVER GO WRONG with Ray!

Linda

lasho, I guess your post got deleted, but there's no
need to try to try to break into someone's
server to download their password file, I'll give
you a couple.
Currently I live at 505 West Buck Street in Caldwell, TX.
If you can crack the one created with the
Strongbox utilities using recommended settings before
I change my address twice, I'll fly you out to the next
convention and then buy you a beer while there.
Though my posts here and the owner's manual
caution against it, Strongbox can also use a weaker type
of password file. I've posted a link to the weaker password file too,
again using the Strongbox utilities to pick the passwords.
If you can crack it while I still live in Caldwell
I'll buy you a beer too.

Here's a password file generated with recommended settings:
http://bettercgi.com/tmp/sbpasses.txt

Weaker settings (not recommended, but still better than most):
http://bettercgi.com/tmp/sbpasses_weaker.txt

BTW, I'm not sure you're on about about ME saying
how good Strongbox is. Read this thread or any other
thread about Strongbox. It's not ME saying how
well it works, it's the webmasters using it who
seem to be quite happy with it overall.
I'm fortunate that some of the people who have posted
are well known in the industry, such as the owners
of a couple of the biggest boards. I'm very grateful
to the people who have posted. The word of mouth
has kept us busy without having to charge very much
because we don't spend thousands of dollars
on advertising each month, which is wonderful.
I'm also glad that some of the high profile webmasters,
such as the owners of the boards, were happy with
the service I provided when I was running their
servers, as that goodwill certainly has something to
do with why they would bother to post these
wonderful things.
On that note, I better stop typing and go work on
Kevin's modifications to his script before he stops
posting nice things. Cheers!

Why can't people just leave other people and their work alone? Glad his post was deleted!