IP protect your admin interface

Menu: User / Allowed IPs

Like it or not, hackers will try break into any script installed on your server and TE3 is no exception. After they gain access to the admin interface of the script, it is much easier to gain access to the server as well. Same goes for the opposite. If they gain access to your server they can change files owned by your user, meaning they can also overwritte legit TE3 files with harmful ones and often that can be tricky for you to notice.

You should use all of the available security measures to make that task as hard as possible for them. We will describe two measures how you can and should protect yourself. TE3's “Allowed IPs” module & .htaccess file protection. It is strongly recommended that you use at least one method. Of course .htaccess method might be better, it is bullet proof (IPs / IP blocks are blocked on the server level) and it is also more flexible (you can specify exactly which files you want to block), but for a novice user it might be a bit trickier to configure. For additional protection, you can use both methods simultaneously.

Allowed IPs:

It only protects TE3 files that should never be opened to the public (no function or meaning to open them to the public). It doesn't protect files such as signup.php, because these files are usually opened to public. We understand there are many webmasters that would like to make their own list of protected files. If that is the case, you should use more flexible .htaccess method instead (read the next chapter).

Protected PHP files: index.php, rlogin.php
Unprotected PHP files: in.php, out.php, signup.php, webmaster_stats.php, securityimage.php

If you have a static IP (IP is never changing) on your home machine, it is very simple to configure “Allowed IPs” module:

Step by step

Open User drop down menu in the Admin panel and click on Allowed IPs,

Select allowed module,

Check box Add my current IP to the list in case it is not already there,

Optionally add additional allowed IPs,

Press Update button.

If your IP is changing all the time, you can still configure it, but it might be a bit tricker. Usually internet service providers will only change last one or last two numbers of your IP. If that is the case, simply add your whole block. Even if you will add a whole IP block, you will reduce the number of potential hackers to nearly zero. Users that are not listed in the “Allowed IPs” module and/or htaccess, will get: Your IP is not on the access list / Forbidden message.

You can add one or multiple IPs at the same time. To enter multiple IPs, add one IP per line. You can add a whole IP block to the list as well (x. - A block, x.x. - B block, x.x.x. - C block). If the last character in the string is . (dot), a whole block will be blocked. Single IPs must be added in the x.x.x.x scheme. TE3 will prevent adding duplicated IPs / IP blocks and IPs or IP blocks that are out powered by a lower IP block. This way your list will always remain clean and fast.

.htaccess:

IP protection with htaccess is more flexible than “Allowed IPs” module as it allows you to specify files you want to protect. It is supposed to be bulletproof as it is based on the server level. Different webmasters have different demands. Check the list of all the TE3's PHP files with descriptions. Based on that you should be able to decide which files you need IP protected and which ones will have to remain opened to the public.

Step by step

Open User drop down menu in the Admin panel and click on Allowed IPs,

Select htaccess file protection,

Insert .htaccess code into text area (see example below for additional explanation),

Press Update button.

Example of .htaccess protection

Here is an example of how .htaccess protection should look like. You can use (copy paste) the example and feel free to modify it. Add additional files if you don't need them opened to the public and want to protect them. As you can see, in this example protected files are: index.php and rlogin.php. And let's imagine your server's IP is 210.10.15.20 and your home IP is always changing the last two numbers (first two numbers are 90.60. ). You can add it like this:

<files ~ "(index\.php|rlogin\.php)">
Order Allow,deny
Allow from 210.10.15.20 90.60.
</files>

PHP files inside /te3/ directory

Here is a brief description of the PHP files inside /te3/ directory, so you can better understand what is their task and which of them should be IP protected.

cron.php: TE3 uses a pseudo-cron method to execute tasks such as stats recalculation, toplist creation, mailing and so on. cron.php module is triggered by in.php. It has to be opened to the public.
in.php: Module for tracking incoming traffic. It has to be opened to the public.
index.php: TE3's admin interface. Protect it!
out.php: Module for tracking outgoing traffic. It has to be opened to the public.
rlogin.php: If you have multiple TE3 sites linked together into a network, remote login (rlogin.php) serves as an inter-communication module for network tasks such as: Switching between sites, exporting trades, syncing blacklist, syncing search engine list and so on. If you only have one TE3, you won't need rlogin.php module at all and therefore you can IP protect it. In case you have two or more TE3s linked together into a network, you can still IP protect 'rlogin.php, but you will have to add both, your personal and your server IP to the “allowed IPs” and/or “.htaccess”. Protect it!
securityimage.php: If you have the “security image” feature enabled in the option / webmaster menu to prevent robot trade sign-ups, securityimage.php module displays security image on the signup.php page. If you have webmaster sign-up page opened and the “security image check” feature enabled, then you have to keep securityimage.php opened to the public, otherwise you can IP protect it.
signup.php: Webmaster sign-up page. Your trade partners can sign-up new trades on this page. If you have your webmaster page closed anyway, you can IP protect it.
te_redirect.php: Incoming tracking method that also allows redirections. If you don't use te_redirect.php, you can IP protect it.
webmaster_stats.php: Webmaster statistics page. Your trade partners can login and view trade stats from this page. If you have your webmaster stats page closed anyway, you can IP protect it.