Details
-
Type:
Improvement
-
Status: Open
-
Priority:
Major
-
Resolution: Unresolved
-
Affects Version/s: 3.0.0
-
Fix Version/s: Long Term
-
Component/s: None
-
Labels:None
Description
Currently the system only logs login attempts with a valid username. Instead, the system should log all login attempts whether the username exists or not.
The system currently limits login attempts to 10 per hour per IP, however this only applies to existing usernames. Attempts to log in with usernames that do not exist are not bound by this restriction, thus an attacker could potentially gain information about which username is valid by receiving the appropriate (blocked) error message after attempting a username 10 times.
To correct the issue, the log_users table should be updated to record the username of the user attempted, and set user_id to '0' to indicate not match on user ID. Then Users::login() must be updated to log the attempt if validation values with the appropriate data. Next, Users::validateLoginAttempts must be updated to leftJoin from log_users with users as opposed to inner join.
Issue Links
- blocks
-
CORE-977
Add event: On user authentication
-
- Open
-
Activity
Not sure if there is a separate task, but valid username login attempts appear to be logged as successful even though they were unsuccessful. In the logs, it then appears as if hackers were able to login as administrators for example.
Paul Phillips
added a comment - Not sure if there is a separate task, but valid username login attempts appear to be logged as successful even though they were unsuccessful. In the logs, it then appears as if hackers were able to login as administrators for example. This task may no longer be necessary with the intended use of Monolog in the future.
Tyson Phillips (Inactive)
added a comment - This task may no longer be necessary with the intended use of Monolog in the future. 
This must work for any username, as CORE-977 will pass those along to the event handler and we need to be able to prevent DOS for nonmatching usernames.
There should be an update log entry to update when a login request can be linked to a user ID.