Add failed authentication attempt logger #835
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When `isAuthed()` is called and the password cookie is not what we expected, the failed login attempt is logged with the provided password, remote address and user agent. To allow for logging failed attempts with a reverse proxy, the `--trust-proxy` argument has been added to trust the `X-Forwarded-For` header. This implementation of an `X-Forwarded-For` parser uses the last value in the list, therefore only trusting the nearest proxy.
Closed
kylecarbs
approved these changes
Jul 8, 2019
|
Added a Fail2Ban filter conf file and a documentation page under |
|
@deansheather I would love to use fail2Ban for code-server, but i cant figure out where the log-file is stored so ican mount it to my letsencrypt container which runs fail2ban. It doesnt seem to appear in the |
|
The failed login attempts are logged to stdout. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When
isAuthed()is called and the password cookie is not what we expected, the failed login attempt is logged with the provided password, remote address, user agent, and timestamp.To allow for logging failed attempts with a reverse proxy, the
--trust-proxyargument has been added to trust theX-Forwarded-Forheader. This implementation of anX-Forwarded-Forparser uses the last value in the list, therefore only trusting the nearest proxy.Describe in detail the problem you had and how this PR fixes it
This allows people to know if their code-server instance is getting attacked, and allows for writing a fail2ban filter for failed login attempts.
The log output looks like the following:
All fields are optional in the log line except the password and timestamp.
Is there an open issue you can link to?
Closes #214.