Skip to content

feat(security): Add a bruteforce protection backend base on memcache - #39870

Merged
nickvergessen merged 7 commits into
masterfrom
perf/noid/memcache-bfp-backend
Aug 22, 2023
Merged

feat(security): Add a bruteforce protection backend base on memcache#39870
nickvergessen merged 7 commits into
masterfrom
perf/noid/memcache-bfp-backend

Conversation

@nickvergessen

@nickvergessennickvergessen commented Aug 14, 2023

Copy link
Copy Markdown
Member

TODO

  • Add memcache based bruteforce protection backend
  • Add a commend to read the state
  • Expose the throttle delay as a custom header
  • Add a testing mode to allow integration testing
  • Show admins when they are throttled
    Bildschirmfoto vom 2023-08-17 08-56-15

Checklist

@nickvergessennickvergessen added this to the Nextcloud 28 milestone Aug 14, 2023
@nickvergessennickvergessen self-assigned this Aug 14, 2023
@nickvergessen
nickvergessen marked this pull request as draft August 14, 2023 17:20
Comment threadconfig/config.sample.php Outdated
Comment threadcore/Command/Security/BruteforceAttempts.php Fixed

$data = [
'allow-listed' => $this->throttler->isIPWhitelisted($ip),
'attempts' => $this->throttler->getAttempts(

Check notice

Code scanning / Psalm

DeprecatedMethod

The method OCP\Security\Bruteforce\IThrottler::getAttempts has been marked as deprecated
$ip,
(string) $input->getArgument('action'),
),
'delay' => $this->throttler->getDelay(

Check notice

Code scanning / Psalm

DeprecatedMethod

The method OCP\Security\Bruteforce\IThrottler::getDelay has been marked as deprecated
@nickvergessen
nickvergessenforce-pushed the perf/noid/memcache-bfp-backend branch 3 times, most recently from 9bae121 to 2a6e4beCompareAugust 16, 2023 07:21
Comment threadcore/Command/Security/BruteforceAttempts.php Fixed
@icewind1991

Copy link
Copy Markdown
Member

I've created a similar bruteforce stats command recently: #39580

@nickvergessen
nickvergessenforce-pushed the perf/noid/memcache-bfp-backend branch from 2a6e4be to 0c7bc29CompareAugust 16, 2023 10:15
@nickvergessen
nickvergessenforce-pushed the perf/noid/memcache-bfp-backend branch from e33b647 to 90bfa01CompareAugust 17, 2023 07:01
@nickvergessen

Copy link
Copy Markdown
MemberAuthor

/backport to stable27

Comment threadapps/settings/lib/Controller/CheckSetupController.php Fixed
Comment threadapps/settings/lib/Controller/CheckSetupController.php Fixed
@nickvergessen
nickvergessenforce-pushed the perf/noid/memcache-bfp-backend branch 2 times, most recently from 6816c17 to 3d9b2adCompareAugust 18, 2023 11:02
@nickvergessennickvergessen added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Aug 18, 2023
@nickvergessen
nickvergessen marked this pull request as ready for review August 18, 2023 11:03
'cronInfo' => $this->getLastCronInfo(),
'cronErrors' => $this->getCronErrors(),
'isFairUseOfFreePushService' => $this->isFairUseOfFreePushService(),
'isBruteforceThrottled' => $this->throttler->getAttempts($this->request->getRemoteAddress()) !== 0,

Check notice

Code scanning / Psalm

DeprecatedMethod

The method OCP\Security\Bruteforce\IThrottler::getAttempts has been marked as deprecated
Similar to the ratelimit backend
Signed-off-by: Joas Schilling <coding@schilljs.com>
…oesn't sleep
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
nickvergessenforce-pushed the perf/noid/memcache-bfp-backend branch from 3d9b2ad to 09cba0dCompareAugust 21, 2023 14:36
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
nickvergessenforce-pushed the perf/noid/memcache-bfp-backend branch from 09cba0d to bed3ffbCompareAugust 21, 2023 14:40
@nickvergessen
nickvergessen merged commit 82835ea into masterAug 22, 2023
@nickvergessen
nickvergessen deleted the perf/noid/memcache-bfp-backend branch August 22, 2023 06:32
@backportbot-nextcloud

Copy link
Copy Markdown

The backport to stable27 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable27
git pull origin stable27
# Create the new backport branch
git checkout -b fix/foo-stable27
# Cherry pick the change from the commit sha1 of the change against the default branch# This might cause conflicts. Resolve them.
git cherry-pick abc123
# Push the cherry pick commit to the remote repository and open a pull request
git push origin fix/foo-stable27

More info at https://docs.nextcloud.com/server/latest/developer_manual/getting_started/development_process.html#manual-backport

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants

@nickvergessen@icewind1991@AndyScherzinger@st3iny@solracsf@github-advanced-security