search

convissor / login-security-solution

Development of the login-security-solution WordPress plugin happens here.
33 stars 21 forks source link

readme

=== Login Security Solution === Contributors: convissor Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=danielc%40analysisandsolutions%2ecom&lc=US&item_name=Donate%3a%20Login%20Security%20Solution&currency_code=USD&bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted Tags: login, password, passwords, strength, strong, strong passwords, password strength, idle, timeout, maintenance, security, attack, hack, lock, lockdown, ban, brute force, brute, force, authentication, xml-rpc, auth, cookie, users Requires at least: 3.3 Tested up to: 4.4 Stable tag: trunk

Security against brute force attacks by tracking IP, name, password; requiring very strong passwords. Idle timeout. Maintenance mode lockdown.

== Description ==

A simple way to lock down login security for multisite and regular WordPress installations.

= Improvements Over Similar WordPress Plugins =

For reference, the similar plugins include:

= Compatibility with Other Plugins =

Some plugins provide similar functionality. These overlaps can lead to conflicts during program execution. Please read the FAQ!

= Translations =

= Source Code, Bugs, and Feature Requests =

Development of this plugin happens on GitHub. Please submit bug and feature requests, pull requests, wiki entries there. Releases are then squashed and pushed to WordPress' Plugins SVN repository. This division is necessary due having being chastised that "the Plugins SVN repository is a release system, not a development system."

Old tickets are in the Plugins Trac.

= Strong, Unique Passwords Are Important =

Yeah, creating, storing/remembering, and using a different, strong password for each site you use is a hassle. But it is absolutely necessary.

Password lists get stolen on a regular basis from big name sites (like Linkedin for example!). Criminals then have unlimited time to decode the passwords. In general, 50% of those passwords are so weak they get figured out in a matter of seconds. Plus there are computers on the Internet dedicated to pounding the sites with login attempts, hoping to get lucky.

Many people use the same password for multiple sites. Once an attacker figures out your password on one site, they'll try it on your accounts at other sites. It gets ugly very fast.

But don't despair! There are good, free tools that make doing the right thing a piece of cake. For example: KeePassX, KeePass, or 1Password

= Securing Your WordPress Site is Important =

You're probably thinking "There's nothing valuable on my website. No one will bother breaking into it." What you need to realize is that attackers are going after your visitors. They put stealth code on your website that pushes malware into your readers' browsers.

According to SophosLabs more than 30,000 websites are infected every day and 80% of those infected sites are legitimate. Eighty-five percent of all malware, including viruses, worms, spyware, adware and Trojans, comes from the web. Today, drive-by downloads have become the top web threat.

-- Security Threat Report 2012

So if your site does get cracked, not only do you waste hours cleaning up, your reputation gets sullied, security software flags your site as dangerous, and worst of all, you've inadvertently helped infect the computers of your clients and friends. Oh, and if the attack involves malware, that malware has probably gotten itself into your computer.

== Installation ==

  1. Before installing this plugin, read the FAQ!

  2. If your WP install is behind a proxy or load balancer, please be aware that this plugin uses the REMOTE_ADDR provided by the web server (as does WordPress' new comment functionality and the Akismet plugin). If you want our brute force tracking to work, we advise adjusting your wp-config.php file to manually set the REMOTE_ADDR to a data source appropriate for your environment. For example:

        $_SERVER['REMOTE_ADDR'] = preg_replace('/^([^,]+).*$/', '\1',
        $_SERVER['HTTP_X_FORWARDED_FOR']);

  3. Download the Login Security Solution zip file from WordPress' plugin site: https://wordpress.org/plugins/login-security-solution/

  4. Unzip the file.

  5. Our existing tests are very effective, catching all of the 2 million entries in the Dazzlepod password list. But if you need to block specific passwords that my tests miss, this plugin offers the ability to provide your own dictionary files.

    Add a file to the pw_dictionaries directory and place those passwords in it. One password per line.

    Please be aware that checking the password files is computationally expensive. The following script runs through each of the password files and weeds out passwords caught by the other tests:

        php utilities/reduce-dictionary-files.php

  6. If your website has a large number of non-English-speaking users:

    • See if a keyboard sequence file exists in this plugin's pw_sequences directory for your target languages. The following steps are for left-to-right languages. (For right-to-left languages, flip the direction of the motions indicated.)

      • Open a text editor and create a file in the pw_sequences directory
      • Hold down the shift key
      • Press the top left character key of the keyboard. NOTE: during this entire process, do not press function, control or whitespace keys (like tab, enter, delete, arrows, space, etc).
      • Work your way across the top row, pressing each key across the row, one by one
      • Press the left-most character key in the second row
      • Go across the second row pressing each key
      • Continue through the entire keyboard in the same manner
      • Let go of the shift key
      • Re-start the process at the top left key of the keyboard and work your way through the keyboard, now in lower-case mode
      • Save the file and close the editor
      • Feel free to submit the files to me so others can use it. See the features request section, below.

    • If a translation file for your language does not exist in this plugin's languages directory, add one. Read http://codex.wordpress.org/I18n_for_WordPress_Developers for details. The files must use UTF-8 encoding. Send me the file and I'll include it in future releases. See the features request section, below.

  7. The last step of the new password validation process is checking if the password matches an entry in the dict program. See if dict is installed on your server and consider installing it if not. http://en.wikipedia.org/wiki/Dict

  8. Upload the login-security-solution directory to your server's /wp-content/plugins/ directory

  9. Activate the plugin using WordPress' admin interface:

    • Regular sites: Plugins
    • Sites using multisite networks: My Sites | Network Admin | Plugins

  10. Adjust the settings as desired. This plugin's settings page can be reached via a sub-menu entry under WordPress' "Settings" menu or this plugin's entry on WordPress' "Plugins" page. Sites using WordPress' multisite network capability will find the "Settings" and "Plugin" menus under "My Sites | Network Admin".

  11. Run the "Change All Passwords" process. This is necessary to ensure all of your users have strong passwords. The user interface for doing so is accessible via a link in this plugin's entry on WordPress' "Plugins" page.

  12. Ensure your password strength by changing it.

= Hooks =

Login Security Solution provides hooks in critical methods, allowing you to add custom behaviors.

== Actions ==

== Filters ==

The following filters allow customizing email subjects and messages. If either the "subject"or "message" filters in a method returns an empty string, the given method will skip calling wp_mail().

= Unit Tests =

A thorough set of unit tests are found in the tests directory.

The plugin needs to be installed and activated before running the tests.

To execute the tests, cd into this plugin's directory and call phpunit tests

Translations can be tested by changing the WPLANG value in wp-config.php.

Please note that the tests make extensive use of database transactions. Many tests will be skipped if your wp_options and wp_usermeta tables are not using the InnoDB storage engine.

= Removal =

  1. This plugin offers the ability to remove all of this plugin's settings from your database. Go to WordPress' "Plugins" admin interface and click the "Settings" link for this plugin. In the "Deactivate" entry, click the "Yes, delete the damn data" button and save the form.

  2. Use WordPress' "Plugins" admin interface to click the "Deactivate" link

  3. Remove the login-security-solution directory from the server

In the event you didn't pick the "Yes, delete the damn data" option or you manually deleted the plugin, you can get rid of the settings by running three queries. These queries are exapmles, using the default table name prefix of, wp_. If you have changed your database prefix, adjust the queries accordingly.

    DROP TABLE wp_login_security_solution_fail;

    DELETE FROM wp_options WHERE option_name LIKE 'login-security-solution%';

    DELETE FROM wp_usermeta WHERE meta_key LIKE 'login-security-solution%';

== Frequently Asked Questions ==

= Compatibility with Other Plugins =

= Why should I pick a user name other than "admin"? =

The WordPress installation process (currently) defaults to having the main administrator's user's name be "admin." Many people don't change it. Attackers know this, so now all they need to do to get into such sites is guess the password.

In addition, if you try to log in while your site is being attacked, this plugin will send you through the password reset process in order to verify your identity. While not the end of the world, it's inconvenient.

= Where did the "Change All Passwords" interface go? =

A link to the page is found in this plugin's entry in the "Plugins" admin interface:

= I just got hit with 500 failed logins! Why isn't this plugin working?!? =

Let's turn the question around: "How long did it take to get in those 500 hits?" Chances are it took hours. (Six hours if they're attacking with one thread, 2 hours if they're coming at you with three threads, etc.) If this plugin wasn't working, they'd have pulled it off under a minute. Similarly, without the slowed responses this plugin provides, an attacker given six hours against your site could probably get in over 170,000 hits.

Anyway, my real question for you is "Did they get in?" I'll bet not. The strong passwords this plugin requires from your users lowers the chances of someone breaking in to just about zero.

And even if they do get lucky and figure out a password, Login Security Solution realizes they're miscreants and kicks them out.

= Will you provide lock outs / blocks in addition to slow downs? =

If you look at it the right way, Login Security Solution provides lockouts (where "lockout" means "denies access" to attackers.) Below is a comparison of the attack handling logic used by Limit Login Attempts and Login Security Solution.

Limit Login Attempts

Note, this approach means an actual user can be denied access for 12 hours after making 4 mistakes.

Login Security Solution

So both plugins deny access to attackers. But Login Security Solution has the bonuses of letting legitimate users log in and slowing the attacks down. Plus LSS monitors user names, passwords, and IP's for attacks, while all of the other plugins just watch the IP address.

= Won't the slowdowns open my website to Denial of Service (DOS) attacks? =

Yeah, the DOS potential is there. I mitigated it for the most part by disconnecting the database link (the most precious resource in most situations) before sleeping. But remember, distributed denial of service attacks are fairly easy to initiate these days. If someone really wants to shut down your site, they'll be able to do it without even touching this plugin's login failure process.

= Where should I report bugs and feature requests? =

Development of this plugin happens on GitHub. Please submit bug and feature requests, pull requests, wiki entries on our GitHub.

= Information for Translators =

  1. Do not commit the .mo files! They get created as part of the release process.
  2. Translation commits and pull requests should only touch the .po file. If you have other changes you wish to see made, please do so via separate commits in separate pull requests.
  3. When translating a new feature, please make that one commit. If other parts of the translation need updating, please make them in a separate commit.
  4. Please don't change formatting inside the .po file
  5. Run git diff before all commits. Ensure only expected changes are being made.
  6. Do NOT translate items that have a comment above them saying Translation from WordPress. DO NOT TRANSLATE IT IN THIS PLUGIN. When starting a new translation, please take a look at an existing .po file to see which strings they are. Those phrases are already translated in WordPress' core. Leaving them untranslated here ensures consistency with the rest of WordPress.

  7. To start a new translation:

    cd languages

# Adjust "lc" to your language code.
# Adjust "CC" to your country code.
cp login-security-solution.pot login-security-solution-lc_CC.po

# Edit the new login-security-solution-lc_CC.po file.

= Translation Information for Developers =

== Changelog ==

= 0.56.0 (2016-08-13) =

= 0.55.0 (2016-01-30) =

= 0.54.0 (2016-01-27) =

= 0.53.0 (2015-09-25) =

= 0.52.0 (2015-05-25) =

= 0.51.0 (2015-03-15) =

= 0.50.0 (2014-12-25) =

= 0.49.0 (2014-11-10) =

= 0.48.0 (2014-10-17) =

= 0.47.0 (2014-10-15) =

= 0.46.0 (2014-10-03) =

= 0.45.0 (2014-08-17) =

= 0.44.0 (2014-05-30) =

= 0.43.0 (2014-01-16) =

= 0.42.0 (2013-07-06) =

= 0.41.0 (2013-06-26) =

= 0.40.0 (2013-06-22) =

= 0.39.0 (2013-05-29) =

= 0.38.0 (2013-05-27) =

= 0.37.0 (2013-04-29) =

= 0.36.0 (2013-04-13) =

= 0.35.0 (2013-02-22) =

= 0.34.0 (2012-10-21) =

= 0.33.0 (2012-10-18) =

= 0.32.0 (2012-10-04) =

= 0.31.0 (2012-09-25) =

= 0.30.0 (2012-09-17) =

= 0.29.0 (2012-09-17) =

= 0.28.1 (2012-09-15) =

= 0.28.0 (2012-09-15) =

= 0.27.0 (2012-09-04) =

= 0.26.0 (2012-09-01) =

= 0.25.0 (2012-08-30) =

= 0.24.0 (2012-08-29) =

= 0.23.0 (2012-08-24) =

= 0.22.0 (2012-08-17) =

= 0.21.0 (2012-08-07) =

= 0.20.2 (2012-07-12) =

= 0.20.1 (2012-07-12) =

= 0.20.0 (2012-07-12) =

= 0.19.0 (2012-07-11) =

= 0.18.0 (2012-07-11) =

= 0.17.0 (2012-07-09) =

= 0.16.0 (2012-07-08) =

= 0.15.0 (2012-07-06) =

= 0.14.0 (2012-07-05) =

= 0.13.0 (2012-07-01) =

= 0.12.0 (2012-06-30) =

= 0.11.0 (2012-06-28) =

= 0.10.0 (2012-06-16) =

= 0.9.0 (2012-06-16) =

= 0.8.0 (2012-04-29) =

= 0.7.0 (2012-04-25) =

= 0.6.1 (2012-04-19) =

= 0.6.0 (2012-04-18) =

= 0.5.0 (2012-04-18) =

= 0.4.0 (2012-04-17) =

= 0.3.0 (2012-04-04) =

= 0.2.1 (2012-04-03) =

= 0.2.0 (2012-04-03) =

= 0.1.0 (2012-03-26) =

= 0.0.4 (2012-03-22) =

= 0.0.3 =

= 0.0.2 =

= 0.0.1 (2012-03-19) =

== Other Notes ==

= Inspiration and References =

= To Do =