How to block Brute force attack

meetdilip

I guess Vanilla is admin account is unprotected against brute force attack since there is no log in attempt limits in Vanilla.

Please correct me if I am wrong.

peregrine

@meetdilip

you could also easily block logins for admin accounts from any ip except those in a whitelist ( a ip block or list of allowed ips). pm me if you are interested.

Bleistivt

No, but there is rate limiting for logins if you have a cache enabled.

meetdilip

Explain please..

Linc

There's rate limiting enabled regardless of caching, which blocks any brute force attempts.

The basic idea is that we do not allow more than 1 login attempt per X seconds, where X is a speed no human can achieve, but slow enough it would take a bot decades to brute force your password.

It's much more elegant than locking your account because a troll decided to mess with you.

peregrine

@meetdilip

you could also easily block logins for admin accounts from any ip except those in a whitelist ( a ip block or list of allowed ips). pm me if you are interested.

Bleistivt

@Linc doesn't that mean it won't ratelimit if no cache is enabed?

https://github.com/vanilla/vanilla/blob/master/applications/dashboard/models/class.usermodel.php#L3482

Linc

@Bleistivt I don't really have time to dig into this right now, but I'll say that if that truly is the only rate limiting functionality, it's problematic and should be addressed as a bug in my opinion. We should never have a no-cache fallback that provides less security.

meetdilip

How can I enable cache ? Also any chance we can have 2 factor authentication in place like Joomla and Gmail ?

Bleistivt

@Linc said:
Bleistivt I don't really have time to dig into this right now, but I'll say that if that truly is the only rate limiting functionality, it's problematic and should be addressed as a bug in my opinion. We should never have a no-cache fallback that provides less security.

Yes, seems to be the only rate limiting functionality. Started a pull request: https://github.com/vanilla/vanilla/pull/2346

@meetdilip‌ said:
How can I enable cache ?

See your other thread.

Also any chance we can have 2 factor authentication in place like Joomla and Gmail ?

What kind of 2 factor authentification?
You could switch to social-login only and leave the authentification to GooglePlus, for example.

x00

You might be interested in @businessdad‌ paid plugin which provides some brute force protection.

businessdad

@x00 said:
You might be interested in businessdad‌ paid plugin which provides some brute force protection.

Soon to become free, I have to add.

almostbasic

Does version 2.2 have login rate limiting?

Bleistivt

@almostbasic said:
Does version 2.2 have login rate limiting?

Yes. And if you have an active cache, 2.1 already has it.