Changing "block message"

Posted: Sun Jan 16, 2005 4:27 pm

I'm using Sentinel 1.20.

When someone gets blocked they get a message once, and after that they just can't access the domain anymore. I would like to change the text in the message. I is like this:

Quote:

This IP has been blocked from ***

Your IP: ***
Your Agent: ***

If you think it was blocked by mistake, please contact
***

Also I would like blocked visitors to get that page everytime they try to visit the site in stead of:

Quote:

Forbidden
You don't have permission to access / on this server.

Any suggestions?

EDIT
And a small question: if the setting "Block" is off, does that mean the attempt isn't prevented or does that mean that the ip adres isn't saved?

Posted: Sun Jan 16, 2005 4:56 pm

You can edit the messages displayed in the abuse directory are the templates pretty much just basic html.

The permission denied is your Apache error handler you can if you have access customize that message or not use the htaccess ban then blocked users will get the abuse page for the specific blocker that was fired off.

Block means block access to the site. This is all covered in depth in the manual.

Posted: Mon Jan 17, 2005 9:12 am

No template files in mine abuse dir. The only files I've in there are:
.htaccess
abuse.php
abuse.swf
GanjaUKevil.swf
index.html

You're sure there should be template files with the 1.20 version?

And about the settings, the manual states this with the email setting:

Quote:

Email Admin - Sends an email to the Admin(s) listed in the NukeSentinel™ Administration page

So my conclusion would be that it doesn't block the attack, it just sends me an email. However that seems not logical. So does it just block that one attack and nothing more?

Worker Joined: Aug 06, 2004 Posts: 192

You should really upgrade to 2.1.3
You are using a real old version.

The tpl files began with 2.0 I think.

Posted: Mon Jan 17, 2005 5:11 pm

Maybe so, but I won't upgrade just for the error message, I just want an answer on my questions.

I don't think it's worth all the trouble upgrading. Is there any significant reason why I should upgrade? Is for example, my version not capable of blocking hackers when compared to the newest version? I'm using nuke 6.9 btw.

Posted: Mon Jan 17, 2005 8:35 pm

Well Six provided the answer to one of your questions. Don't set the ip address to be written to .htaccess . You would then have to remove any entry already there. That would stop the forbidden message.

I am not sure how to change the display in 1.2 because the newest uses simple tpl files.

I am pretty sure that the newest version 2.1.3 is faster, more secure, and protects your site better, but Raven, Bob, or six would have to confirm this.

Posted: Tue Jan 18, 2005 8:08 am

Hmm, ok I will have to think about it. One more thing though: is the newest version more user friendly or does it look more complex compared to the older ones?

Posted: Tue Jan 18, 2005 11:54 am

No it very user friendly. Every option has a "?" that when you are putting your mouse over it, it explains the feature.

Posted: Tue Jan 18, 2005 12:26 pm

Ah ok. Well, I think I will try it out. Problem is, that I've tweaked my sentinel system, so that all my sites use the same installation and database.

I've still this question though: does the 'Email admin' setting only email when a hack is attempted, or does it also block the attack?

Posted: Tue Jan 18, 2005 1:38 pm

This is from the sentinel manual

Quote:

Off - Turns off this protection method
Email Admin - Sends an email to the Admin(s) listed in the NukeSentinel™ Administration page
Forward - Forwards the attacker to the URL listed in the Forward to.
Default Page - Sends the attacker to the default NukeSentinel™ banned page
Email & Forward - Sends an email, and forwards attacker to the URL
Email & Default Page - Sends an email and sends attacker to the default page
Email, Block & Forward - Sends an email, blocks the IP by adding to .htaccess and the database, and forwards to the URL
Email, Block, & Default Page - Sends an email, blocks the IP by adding to .htaccess and the database, and sends the attacker to the default page

As long as its not turned to "off" the attack will be blocked. If you set it to 'Email Admin' the hack will be blocked and you will be notified.

Client Joined: Apr 15, 2003 Posts: 466 Location: FL

I'm so thankful for people with patience. Wink

Posted: Wed Jan 19, 2005 5:29 pm

Yo Deseroka, as I wrote a few posts before, if it just says 'Sends an email' how can I know for sure that it also blocks the attack?

Anyway, JRSweets, do not think I don't appreciate your patience, 'cause I do Wink

! Thanks for all the info!

Posted: Thu Jan 20, 2005 11:11 am

Have someone try a exploit and set it to "Send an email". And see what it does.