Kirby Notifier - a panel security plugin

Plugins Discontinued
1

###Kirby Notifier can be [downloaded for free] (https://github.com/1n3JgKl9pQ6cUMrW/kirby-notifier) from GitHub.

Kirby - Notifier

Version 0.0.1 / November, 23rd 2015 - intial public offering.

Send an email to the admin, everytime a user has logged in to the panel.

What is it?

Kirby Notifier is a simple plugin that notifies the sites administrator by mail, everytime an user has logged in to the panel.

The plugin works standalone and is inspired by the Wordpress’ Wordfence plugin ( https://www.wordfence.com/ )

Why is it?

It helps admins to keep an eye on their site-usage and it can warn them when someone logs in under aberrant circumstances.

How to install?

  1. Copy / paste the directory /site/plugins/notifier (and all of it’s files) to your own Kirby-site.

  2. Set some preferences in site/config/config.php (see _config.php for the basic settings).

  3. kirbyNotifierEmail - the email-address of the sites administrator

  4. kirbyNotifierPanel - the root-folder of Kirbies panel (defaults to panel)

  5. kirbyNotifierRemote - whether or not the plugin is allowed to call a remote server *)

*) The remote server is called for detailed location information about the logged in user. No private data is send, only the users IP-address, which will return a longitude / langitude and country / city.

This Location-data is provided for free by http://www.hostip.info/ and http://www.geoplugin.com/ (no need to register, but can be helpfull).

How does the email look like?

Subject - [Kirby Notifier] WebsiteName login

From - do-not-reply@websitename.com

Date - Mon, 23 Nov 2015 20:39:37 +0100

To - admin@websitename.com

This email was sent from the site "WebsiteName" by the Kirby Notifier plugin.

An user with username "John Doh!" who has administrator privileges just signed in.

If you think this login is erroneous, you can contact the user "FirstName LastName" at user@websitename.com

---
Login details;
---

Date : Monday, 23rd of November 2015 - 20:39:37

IP-address : 104.85.21.227

Referer : http://websitename.com/panel/login

Location : The United States of America / Washington (approx.)

Map : https://www.google.nl/maps/place//@38.898060,-77.037131,14z/

Language : EN / English

Provider : president.whitehouse.gov

Country : The United States of America

Server : ny009.whitehouse.gov

Domain : websitename.com

System : Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36

---
2 Likes
2

You are caring very much about Kirby’s security, aren’t you? :smiley:

3

@lukasbestle: What do you expect from a user with such a user name :stuck_out_tongue_winking_eye:

1 Like
4

I do trust Kirby’s security 100% … well, that’s not true … I trust it 101% !

But I do “like” the idea that I get mentioned when someone is entering the panel; not because I want to monitor everything, but because I want to know when something is wrong…

As we speak, I am building some major sites - for companies who really care about security… so I am just adding an extra layer of defense;

Not because it is needed by Kirby, but because it is requested by my clients…

I also added .htaccess protection, encrypted usernames, hidden panel-URI’s and a 8-character captcha to the panel… just to be sure :stuck_out_tongue: (and not to be sorry, afterwards).

Pasted image688×727 31.1 KB

5

Sure, that’s totally alright. Adding additional layers is never bad, but as I already wrote, it can give a false sense of security. There’s always a way around everything (and also additional layers can include additional bugs). :wink:

I really like your plugin ideas though! Very inspiring. :smile:

6

Nice :smile:

But this particular plugin is not all about security;

Imagine you have a site with both admins and editors… and the editors can write a story on your site, using the panel;

The plugins sees the difference between an editor and an admin an warns when something is wrong.

So when you have 10 editors, all around the world and suddenly one editor is accessing the website from an “unnormal” country (as in “not the country this editor used to use”) and using a strange IP-address you will be warned the moment it occurs…

No more need to lurk down those server-logs afterwards - and you can filter the incoming emails by subject (I read them for about one second, and delete them at once).

7

Great use-case! Tracking logins in some way is definitely useful. But maybe permissions in Kirby 2.3 will also partly solve this issue.

8

Cool - I just like to write some simple plugins, that’s all :smile:

Even the website of Bernie Saunders (maybe the next president of the USA) is running Wordpress and you still can get to it’s wp-admin panel very easy… I just don’t like the idea of that.

I’m not writing down the sites URI / panel-scheme, but everyone who knows Wordpress knows how to log in on that site…

9

Looks like a good plugin, installed this on a site going live soon. Used to use wordfence too, so this is a nice function

10

Thanks - I have updated the code to work better with Kirby 2.2 and you can configure it from config.php

I will update the GitHub this week.

11

This seems to be deleted or renamed on Github. It it still there? What is the URL?

12

https://github.com/1n3JgKl9pQ6cUMrW/Kirby-Notifier

There were issues after the update to Kirby 2.2 - so I decided to remove it.

This version should be working, but please notice;

The remote API is not always working which can disable access to the Kirby panel; please, be aware of this issue.

You can disable the remote access in the settings (see below), this will not alter the plugin itself.