infrastructure/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2025-07-12 16:24:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

log a consistent log line for failed authentication attempts, with the remote ip

Browse Source 
so external tools (like fail2ban) can monitor the logs and block ip's of bots.

for issue #30 by inigoserna, though i'm not sure i interpreted the suggestion correctly.
This commit is contained in:
Mechiel Lukkien
2023-05-31 20:39:00 +02:00
parent 70d07c5459
commit 713d781bad
4 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
http/admin.go
View File

@ -132,11 +132,14 @@ func checkAdminAuth(ctx context.Context, passwordfile string, w http.ResponseWri
}()
var err error
var remoteIP net.IP
addr, err = net.ResolveTCPAddr("tcp", r.RemoteAddr)
if err != nil {
log.Errorx("parsing remote address", err, mlog.Field("addr", r.RemoteAddr))
} else if addr != nil {
remoteIP = addr.IP
}
if addr != nil && !mox.LimiterFailedAuth.Add(addr.IP, start, 1) {
if remoteIP != nil && !mox.LimiterFailedAuth.Add(remoteIP, start, 1) {
metrics.AuthenticationRatelimitedInc("httpadmin")
http.Error(w, "429 - too many auth attempts", http.StatusTooManyRequests)
return false
@ -164,10 +167,12 @@ func checkAdminAuth(ctx context.Context, passwordfile string, w http.ResponseWri
}
t := strings.SplitN(string(auth), ":", 2)
if len(t) != 2 || len(t[1]) < 8 {
log.Info("failed authentication attempt", mlog.Field("username", "admin"), mlog.Field("remote", remoteIP))
return respondAuthFail()
}
if err := bcrypt.CompareHashAndPassword([]byte(passwordhash), []byte(t[1])); err != nil {
authResult = "badcreds"
log.Info("failed authentication attempt", mlog.Field("username", "admin"), mlog.Field("remote", remoteIP))
return respondAuthFail()
}
authCache.lastSuccessHash = passwordhash