search

micromata / dave

A totally simple and very easy to configure stand alone webdav server
Apache License 2.0
350 stars 46 forks source link

Enable brute force detection? #14

Closed symgryph closed 3 years ago

symgryph commented 4 years ago

If you were to log "User x failed to login" I could use fail2ban to stop evil users from brute forcing me. I could use a proxy, but was curios what you thought about adding this security feature?

chclaus commented 4 years ago

Hej @symgryph,

sorry for delay. Had a lot on my mind... I really like your Idea. Would you implement the feature?

Best, Christian

symgryph commented 4 years ago

Yes I would implement it. We currently use it for some of our developers to upload stuff. I would to get rid of the idiots who are trying to attack me.

chclaus commented 4 years ago

Nice! Thanks a lot. 😊

symgryph commented 4 years ago

I don’t know how to program unfortunately. I thought you meant help you test it.

chclaus commented 4 years ago

Hehe,

all good. We'll get around that. I'm happy to leave it to you for testing :)

chclaus commented 4 years ago

Hej @symgryph,

I've added some unified log output and remote addresses to failed login attempts. You should now find the following three possiblities:

WARN[0023] User failed to login                          address=127.0.0.1 error="username not found or password empty" user=foo
WARN[0035] User failed to login                          address=127.0.0.1 error="Password doesn't match" user=user
WARN[0073] User failed to login                          address=127.0.0.1 error="user not found" user=foo

It would be nice if you could give your two cents to the improvement.

Best, Christian

symgryph commented 4 years ago

does this support ipv6?

Thomas J Munn

On Aug 24, 2020, at 17:31, Christian Claus notifications@github.com wrote:

 Hej @symgryph,

I've added some unified log output and remote addresses to failed login attempts. You should now find the following three possiblities:

WARN[0023] User failed to login address=127.0.0.1 error="username not found or password empty" user=foo WARN[0035] User failed to login address=127.0.0.1 error="Password doesn't match" user=user WARN[0073] User failed to login address=127.0.0.1 error="user not found" user=foo It would be nice if you could give your two cents to the improvement.

Best, Christian

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

chclaus commented 4 years ago

Good point! Now it should. ;)

symgryph commented 4 years ago

I’ll check in a new code tonight and see how it does.

Thomas J Munn

On Aug 25, 2020, at 04:52, Christian Claus notifications@github.com wrote:

 Good point! Now it should. ;)

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

chclaus commented 3 years ago

Feature went into the current release