2FA (2 Factor Authentication) and general security

[Hoayun]

Hi,

I’m just getting TNG site setup for the first time and I wondered if anyone has managed to write a mod for 2FA.

I also wondered what other people do if they want their site to be completely private and largely immune from simple attacks like reading the contents of their backups, photos, etc, since if you can guess filenames then you can just view photos which have a lot of personal identification information which is great news for hackers trying to steal you identity.

Apologies if such a security discussion has already been covered on this forum and I missed it in my searches.

[Rob Severijns]

Have a look here 

for some suggestions

[Rob Severijns]

Mods I use are: 404 Error - TNG_Wiki, Bot Manager - TNG_Wiki, Bot-Trap - TNG_Wiki, Restrict Access mod - TNG_Wiki, Rip Prevention Mod - TNG_Wiki

In addition to that you can use google's recaptcha or Image Captcha - TNG_Wiki. Both these mods work with the Bot Manager mod

Also have a look at several directives to be used in your .htaccess file and robots.txt

 

[Steve1200]

Here are examples of some Apache 2.4 commands that can be used to restrict bot access to select TNG and TNG mod files.

<If "%{HTTP_USER_AGENT} =~ /^.*(ChatGPT|ChatSensei|CogniBot|GPTbot|HelperBot|Lumina|MegaBot|Pixella|Proxima|Quanta|Synthia|TechWhisper).*$/">
    Require all denied
</If>

<FilesMatch "(ahnentafel|anniversaries|calendar|descend|descendtext|descendtables|descendvert|familychart|familygroup|famsearch)\.php">
    <If "%{HTTP_USER_AGENT} =~ /^.*(bot|GPT|GPTBot|slurp|spider|crawler).*$/">
        Require all denied
    </If>
</FilesMatch>

<FilesMatch "(fan|notes|pedigree|pedigreetext|relationshp|relateform|searchform|search|timeline|timeline2|verticalchart)\.php">
    <If "%{HTTP_USER_AGENT} =~ /^.*(bot|GPT|GPTBot|slurp|spider|crawler).*$/">
        Require all denied
    </If>
</FilesMatch>

<FilesMatch "(xerxxIndividMaternalLine|xerxxIndividPaternalLine|xerxxFamilyMaternalLine|xerxxFamilyPaternalLine|parental_line)\.php">
    <If "%{HTTP_USER_AGENT} =~ /^.*(bot|GPT|GPTBot|slurp|spider|crawler|facebookexternalhit).*$/">
        Require all denied
    </If>
</FilesMatch>

 

[Hoayun]

Thanks for sharing your thoughts and suggestions which are all helpful. I've managed to secure quite a lot of the site, but one insecurity that still eludes me is how to prevent non-logged in users from accessing photos that they manage to guess the filename ... let me try and explain below.

Often photo file names might be something like birth_certificate_john_smith.jpg and this is stored in <tng root>/photos. Even if I'm not logged in I can just type mydomainname.com/photos/birth_certificate_john_smith.jpg and I get the photo displayed in my browser. I'm hoping there is an easy way to prevent this since it's eluding me at the moment. Maybe I have something configured incorrectly in my current test setup, but I would be very interested if anyone here who has secured their site has the same security hole if you try it.

You could argue that no one is going to guess that filename, but it would be easy to write a simple bit of code to try various expected combinations of filenames based on knowing some peoples names. It would also be very easy to try and execute various bits of PHP where of course the filenames are definately known to a potential hacker who only has to buy a licence and they get the full source.

[Rob Severijns]

If in Setup >> Configuration >> General Settings >> Privacy

is set to Yes only logged in users can view the content of your family tree.

The mods in my previous reply help blocking clients that try to view your data without being logged in or that tamper with the url.

 

[Steve1200]

I DO NOT recommend storing media files in the TNG root. TNG by default has a few media collections, but you can create your own. Here are the collections on my website:

Births, Marriages, Deaths and Wills were created using the Media page in the TNG admin section.

To create a collection select Add Collection from the page.

So births on the media admin section of my website looks like this:

 

You can use the TNG Media Collections Guide to help understand how to populate the fields. When you create a collection, click the make folder button. This creates a folder where you can store your media for that collection. When you add new media be sure to select which collection you want to store the media in.

After organizing the media files you can use mods to limit access. Some TNG sites are open to the public and some are private. The setting Rob mentioned requires all clients log in to view anything on the website.

My website is public/private meaning clients can see the pages for deceased people but not the living and they cannot view media.

There are a few mods you can use to limit access to media, if your media is stores in collections. I wrote Media Access to prevent the public from viewing media on my website. When someone clicks on a media link they are directed to the login page. However, the Restrict Access mod also limits access to media and has options for other pages. There is also the Secret medias mod which allows clients to view allowed media while hiding other media you choose to make private.

There may be additional mods to address this issue but these are mods I am familiar with.

Anything you put in the TNG root can be scanned. The setting Rob mentioned makes TNG private and prevents clients loading any TNG programs unless they log in. So if you want to require your clients to login, choose this option. However, none of your pages will be indexed by any search engines.

 

[theKiwi]

 

2 hours ago, Steve1200 said:

I DO NOT recommend storing media files in the TNG root.

That's not what he said...

5 hours ago, Hoayun said:

Often photo file names might be something like birth_certificate_john_smith.jpg and this is stored in <tng root>/photos. Even if I'm not logged in I can just type mydomainname.com/photos/birth_certificate_john_smith.jpg

The photos in question ARE in the photos folder and collection.

The question is how to stop people from guessing the name of the image file and so accessing it by its direct URL.

If this is a concern, random, really long file names would do it - but what a pain that would be to deal with!

Roger

[Steve1200]

You're right Roger, I missed the boat on this one and should have read more carefully. Direct access bypasses TNG completely and is a server configuration issue.

If you are using Apache 2.4 commands, try adding the following to your .htaccess file:

<FilesMatch "\.(pdf|jpg|jpeg|png)$">
	Require all denied
	Require ip 127.0.0.1
 </FilesMatch>

IP 127.0.0.1 is a special loopback address. This lets your server access the files but prevents access from any other IP address.

However if that IP does not work correctly on your configuration, you can always enter the actual server IP address.

Note: Apache is case sensitive so if you use both jpg and JPG file extensions list them separately.

Edited August 28, 2025 by Steve1200
Added case note

[Hoayun]

@Steve1200 that .htaccess approach sounds very interesting and I’ll give it a go since it sounds like it will give me what I want: hackers can’t access photos and other private files but TNG still can. So far all the approaches I’ve tried in Apache have ended up either not quite working or have broken TNG in some way.

As you stated the problem is that I’m trying to prevent access to private data such as photos before TNG even starts running, so the solution really needs to be in Apache … or something else I haven’t heard of or understand yet. I am completely new to the world of writing/modifying web related code

[Hoayun]

I’ve just tried that .htaccess Apache and it also blocks accesses from TNG when logged in.

The other approach I’m going to try is to move the folders like photos to the private area on my web server and edit config.php to point to the new location 

[Steve1200]

If it blocks access using IP address 127.0.0.1, you need to change the IP to the address your server is using. I use this command on my site and it works very well.

If you are using a host, check with them as to which IP address should be used so Apache does not block local access.

[Hoayun]

Thanks @Steve1200. I contacted my server provider and there’s a couple of additional IP addresses I also need to include to allow server side access, so that explains why the files were successfully blocked from direct viewing in the browser via a path into photos, but also TNG wasn’t able to access them either 

[Steve1200]

I had issues with direct access to media years ago and it was not people guessing file names. There are a number of unsavory folks using software that searches websites directly, bypassing any website software the server is running.

Once you add the correct info to Apache, TNG should be able to access the media normally.

[tngrlkrz]

1 hour ago, Steve1200 said:

TNG should be able to access the media normally.

So will I still be able to ftp to my host to upload files or do I need to enter my IP address in those .htaccess lines as well?

Ron

[Steve1200]

I normally connect directly, but I just enabled FTP and was able to upload a jpg without any problems. FTP should work because the internet usually runs on port 80 (http) or 443 (https). FTP servers do not use internet ports so unless you have Apache configured to listen to the FTP port, all should be well.

Add the code to your .htaccess file first, then ensure TNG can access the files. Once it is working, upload a file using FTP. Please let me know how it works for you.

[Hoayun]

For FTP I only turn it on in my web host control panel when I want to make changes, then for most of the time it is disabled otherwise that’s another potential big security hole if someone gets in via FTP