Repository navigation
Strongbox configuration: List of Configuration Variables
The following variables can be found in cgi-bin/sblogin/config.pl
We suggest making a back up copy of the config.pl file before making any changes.
We also suggest making only small changes, such as changing “3” to “4”. If you make a large change, like changing “3” to “12”, you will probably be unhappy with the results.
This is a Perl file, if it has syntax errors Strongbox won’t work, if you have shell access you may want to test syntax:
$ perl -c config.pl
config.pl syntax OK
Login attempts from these countries will fail. Please note that Country detection is not always reliable or 100% accurate.
Session Time in days, default: 0.2
Should automatically be set and should not need any change. IF it needs to be manually set for some reason, it should be set to the domain name, usually without the “www”. (Ex: “comglobalit.com”)
Email addresses Strongbox will send notices to if a username is suspended or if there is other suspicious activity. See https://github.com/comglobalit/strongbox/wiki/Strongbox-Notification-Emails
These are the status codes that Strongbox will send notices of. See https://github.com/comglobalit/strongbox/wiki/Strongbox-Notification-Emails
This tells the Strongbox security system the maximum number of emails it should send in a single day. See https://github.com/comglobalit/strongbox/wiki/Strongbox-Notification-Emails
Perl array with locations to Authentication Sources. It can reference multiple databases and/or password files. See Authentication Methods.
Whether or not to use the turing image. See Turing Image
The usernames listed here can NOT get suspended. Use this feature with extreme caution. Do NOT use this to have several people pretend to be the same user with admin privileges. See Strongbox Admin Users
Analogous to invincible_users. Use this feature with extreme caution.
Don’t count these IPs against users. Useful to avoid suspending users because of “login tests” from third parties (despite our recommendation of not doing them, see Helping Customers Who Have Trouble Logging In)
Your default main members’ URI, typically this will be “/members/”
Regular expression for blocked HTTP Referers. Default: ‘pass|hack’, it will match sites like stolenpasswords.example.net
Exceptions for referer_blocks
If set, only one person can use any given user name at any given time. If a second login is attempted, it logs out the first session.
Whether or not to use the proxy check feature to reduce brute force attacks.
For temporary use before the wildcard is set up. Using cookies instead of Newtons (wildcards), read more: https://github.com/comglobalit/strongbox/wiki/Strongbox-Newtons:-in-URL-session-IDs-and-wildcard-domain
Allow the use of deprecated embedded video tags; Reduces security slightly.
Page displayed for user to login. Normally should not be changed.
URL to send them to if they enter a bad password.
Page displayed if user does not enter the turing image correctly. Normally should not be set.
Used for firewall plug-in script.
Used for firewall plug-in script.
Total number of times a user can enter the wrong user name/password combination without getting their account suspended. (actually per 3 hour period)
Total number of IP ranges to suspend a user name. This may be adjusted for proxies. (actually per 3 hour period)
Total number of countries to suspend a user name. This may be adjusted for proxies. (actually per 3 hour period)
Total number of successful logins to suspend a user name. This may be adjusted for proxies. (actually per 3 hour period)
Total number of different ISPs to suspend a user name. This may be adjusted for proxies. (actually per 3 hour period)
Total number of times a user must enter the wrong user name/password combination to get their account suspended. (actually per 48 hour (2 day) period)
Total number of IP ranges to suspend a user name. This may be adjusted for proxies. (actually per 48 hour (2 day) period)
Total number of successful logins allowed per user name. This may be adjusted for proxies. (actually per 48 hour (2 day) period)
Total number of countries to suspend a user name. This may be adjusted for proxies. (actually per 48 hour (2 day) period)
Total number of different ISPs allowed per user name. This may be adjusted for proxies. (actually per 48 hour (2 day) period)
Total number of times a user name can get suspended for unique IPs before getting disabled.
Total number of times a user name can get suspended for unique countries before getting disabled.
Random string set the same for different sites that need to use the Handoff feature. See Handoff
Log used internally by Strongbox to track login attempts. Should not be changed.
Used for debugging Turing Image feature. Should not normally be changed.
Directory for Strongbox internal session database. Should not normally be changed.
Normally set automatically. This is the path to the sendmail program.
How far back Strongbox checks the login history. Should not normally be changed, except on possibly extremely busy or extremely slow sites.
Internal variable used by Strongbox to indicate the log format in use. (Length of each line in its log).
Deprecated feature for using multiple sites with one Strongbox installation.
Variable used by Strongbox relating to Turing Image. Should not normally be changed.
Set for Windows servers to accommodate filename restrictions (We don’t support Windows since long time ago, see Strongbox Requirements).
Set for Windows servers to accommodate file name restrictions (We don’t support Windows since long time ago, see Strongbox Requirements).
Tells whether passwords are stored in a file, a database, or remote server. See Strongbox Admin Users.
Used for authenticating against a remote server to indicate how the remote server will respond for a negative response.
Used for authenticating against a remote server to indicate how the remote server will respond for a positive response.
###site_id Deprecated.
Setting for MYSQL authentication. See Strongbox Admin Users
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Setting for MYSQL authentication. See Authentication Methods
Deprecated variable for use with the old video .cgi. Should not be set for new installations using video2.cgi.
Deprecated variable for use with the old video .cgi. Should not be set for new installations using video2.cgi.
Deprecated variable for use with the old video .cgi. Should not be set for new installations using video2.cgi.