Blacklist IPs for excessive login attempts

S

seachen

Verified User
Joined
Feb 3, 2007
Messages
491
I saw there is "Blacklist IPs for excessive login attempts" function

System will auto send an email.

But it can be better if the system message show the ip trying to login on which user. like this we can inform user about this.
 
Hello,

The feature already does tell you which account is trying to be logged into. It posts the message into the message system, which is linked to in the email.

If the attack is just hammering the port without any login info in the request (just an empty connection), it will just be an empty field, eg:
Code: 
The ip '1.2.3.4' has been added to the /usr/local/directadmin/data/admin/ip_blacklist file for having too many repeated failed login attempts into the '' account.
If there is a user in the login attempt, then it would look more like:
Code: 
The ip '1.2.3.4' has been added to the /usr/local/directadmin/data/admin/ip_blacklist file for having too many repeated failed login attempts into the '[b]bob[/b]' account.
Let me know if I'm not understanding your request.

John
 
I just tested it and it won't show the username it tries to logon to. It just says the '' account while I entered an existing username and F5'd it with the browser sending the post data again.
 
Ya, It only show the warning message with IP. Without telling us which user.
 

Attachments

  • ip.png
    ip.png
    80 KB · Views: 333
Hello,

I just tested on our CentOS 4 test box, using both clicking the login button multiple times with a wrong password, and using the F5 reload method (using Chrome).. and I did get the user in the output. Make sure you're not just reloading the login page without any posted data.

Code: 
The ip '192.168.0.151' has been added to the /usr/local/directadmin/data/admin/ip_blacklist file for having too many repeated failed login attempts into the 'admin' account.

Can anyone else confirm the empty username claim? I'm not able to duplicate it.

Note that you will get the empty '' quotes if there is no username passed in the last request that puts his IP over the login attempt limit.

If no username is passed, then it means the "username" value in the form was blank, or the variable wasn't passed at all, since that's the variable that DA uses to login a User.

John
 
I just tested it again, and indeed it works. I probably pressed enter too much in the F5ing process resulting in sending empty user data.
 
We've received a claim from our client. He could not log in into directadmin.
I'm not sure, if this thing is related to yours. But looking through DA's logs we found out, that his browser Mozilla Firefox did not send username from login form. So there was no username in logs. We could not repeat it by ourselves. The problem was solved by suggesting another browser to our client.
 
When someone is jsut hammering the port and the IP is blacklisted would this help the load go down? does it completely block them from attacking the port any further?
 
The load will go down because nothing is run when they're blacklisted (no parsing of the request, far less code execution, etc), it's much quicker once they're blocked. Also, hammering a blocked port also doesn't do much for them, so they have no reason to continue. DA does tell them they're blacklisted, so the amount of code it takes to write "You are blacklisted" to a socket is all it amounts to.

John
 
You must log in or register to reply here.
Back
Top