UBB.threads PHP Forum Software Community Forums UBB.classic UBB.classic 6 Support questions about Members directory

I've had hacker problems in the past... user accounts got hijacked where publicly displayed name wasnt used to hide login name and then the password was cracked by brute force. During that time, there was one day when an administrator account got hijacked and the hacker played around in my control panel.

Since then I've uploaded the vars_lock file like described in Administrators guide, I've deleted the compromised accounts when possible, started changing password on the member #1 account every day, and even hacked in the standard floodcheck on login to slow down the hackers.

but now I got a brand new administrator account that was compromised and somebody got into my control panel again and deleted other administrator accounts <img src="https://www.ubbcentral.com/boards/images/graemlins/frown.gif" alt="" />

So two questions -
1. Is it possible that the first time they hacked into my control panel they might of made note of the "Members directory" location and their now able to get ahold of login names that way?

2. If the answer to #1 is yes... Can I safely close the board, rename members directory on disk, and then update that config setting in CP without hurting anything?

I'm on ubb.classic 6.7

TIA!

if your Members directory is in your cgi-bin, it's most likely safe.

If it's within the web directory, rename it now! They could easily get any Members entire profile that way.

I have my Members directory so it doesn't even have an address on the internet, only being accessible via ftp

My members directory is in my cgi-bin, and that is above the web root like recommended.

it should be fine then.

Keep in mind that Moderators can see the login's of the Administrators, so if they have a Moderator's password, they just got your Admin login

Safest way to have your members directory is under your web root, where it'll never be accessable to the web. Ask your webhost if they can create a directory under your public_html directory called members, be sure they chmod it 777, then move your members info there. Thats what I'd do anyway <img src="https://www.ubbcentral.com/boards/images/graemlins/wink.gif" alt="" /> ; it's what I did for Ian there lol...

If it's in your cgi-bin, you're safe - the member files are stored with the extension ".cgi", which will cause the server to try and execute them as scripts, which will then fail. There is no way to extract information from the files in that way.