<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Got a new issue:<br>
<br>
<br>
When using username+ ip + port as unique identifier, i saw that
the port is not used too much times. Take a look at this log:<br>
<br>
<br>
{</p>
<p>u'a127.0.0.153634': [{'username': u'a', 'ip': '127.0.0.1',
'port': 53634, 'time': 1484672673.735578}], u'a127.0.0.153636':
[{'username': u'a', 'ip': '127.0.0.1', 'port': 53636, 'time':
1484672676.018149}], u'a127.0.0.153630': [{'username': u'a', 'ip':
'127.0.0.1', 'port': 53630, 'time': 1484672664.44004}],
u'a127.0.0.153632': [{'username': u'a', 'ip': '127.0.0.1', 'port':
53632, 'time': 1484672668.298648}], u'a127.0.0.153628':
[{'username': u'a', 'ip': '127.0.0.1', 'port': 53628, 'time':
1484672661.977025}]</p>
<p>}<br>
</p>
<p>In 5 tries, 5 different ports were used. So, remote port isn't a
good information. <br>
<br>
<br>
I tried to use cherrypy.session.originalid. Which, seems to be
better. take a look at this test:<br>
4 attemps, the first went with a different originalid. The others
with the same:<br>
<br>
{u'a127.0.0.13534ea7fa9cdb23e37ae914f2e6cf7b0e04dab28':
[{'username': u'a', 'ip': '127.0.0.1', 'port': 53770, 'time':
1484673652.558314}], <br>
</p>
<p>u'a127.0.0.1a7f2be8054048de62d2ce90e57939ee5ebb55fae': [</p>
<p>{'username': u'a', 'ip': '127.0.0.1', 'port': 53772, 'time':
1484673655.356095}, <br>
</p>
<p>{'username': u'a', 'ip': '127.0.0.1', 'port': 53774, 'time':
1484673657.863454}, <br>
</p>
<p>{'username': u'a', 'ip': '127.0.0.1', 'port': 53776, 'time':
1484673660.436111}]}<br>
<br>
<br>
<br>
<br>
</p>
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 12/22/2016 01:59 PM, Ramon Medeiros
wrote:<br>
</div>
<blockquote
cite="mid:4744cb7f-3143-5334-1d9c-8514e1373504@linux.vnet.ibm.com"
type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<p>Propose: make adjustments at login page to make difficult brute
force attack.<br>
<br>
Today, an intruder can make login tries without any action from
Wok.<br>
<br>
Possible measures:</p>
<p>Record source port and ip. After 3 tries, block user for 30
seconds and increase the time by each more try. Using source
port and ip will avoid errors for connections from NAT networks.<br>
<br>
Example:<br>
<br>
1) ip 192.168.1.1 tries to login as root 3 times and fail<br>
2) A timeout of 30 seconds will be set<br>
3) After that, for 5 minutes, each try will add 30 seconds + x
times the trial (60 seconds, 90 seconds. ..)</p>
<p>4) After 5 minutes of the last try, the counter will be reset.<br>
</p>
<pre class="moz-signature" cols="72">--
Ramon Nunes Medeiros
Kimchi Developer
Linux Technology Center Brazil
IBM Systems & Technology Group
Phone : +55 19 2132 7878
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:ramonn@br.ibm.com">ramonn@br.ibm.com</a> </pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Kimchi-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Kimchi-devel@ovirt.org">Kimchi-devel@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/kimchi-devel">http://lists.ovirt.org/mailman/listinfo/kimchi-devel</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Ramon Nunes Medeiros
Kimchi Developer
Linux Technology Center Brazil
IBM Systems & Technology Group
Phone : +55 19 2132 7878
<a class="moz-txt-link-abbreviated" href="mailto:ramonn@br.ibm.com">ramonn@br.ibm.com</a> </pre>
</body>
</html>