Brute force detection (password attacks)

[BeberGold]

Hi,

This topic is about brute force, password attacks.

For example, it can be when
1. a single IP address tries several passwords on one user account or multiple accounts
2. several IP addresses target the same account (attempting to guess the password)

Does SMF have a detection for it please?
And perhaps a way to block temporarily an IP address from trying to log in?

Thank you.

[Aleksi "Lex" Kilpinen]

There is logic in SMF to offer some level of protection, and to redirect a user after failed attempts, but off the top of my head I can't really offer a more detailed description. The initial redirect threshold is configurable.

[BeberGold]

There is logic in SMF to offer some level of protection, and to redirect a user after failed attempts, but off the top of my head I can't really offer a more detailed description. The initial redirect threshold is configurable.

This redirection is new to me. Would you know where to find it in the administration panel please?

Apologies if the next question sounds stupid. It is just I would like to better understand what you have in mind. In what way would the redirection be a protection?

[Aleksi "Lex" Kilpinen]

It's "Failed login threshold" under "Security" in the admin control panel.
It will redirect a user to the "Forgot password" page after a set amount of failed login attempts,
interrupting the normal login process.

[shawnb61]

In addition to that, there is password flood detection & control.

If we detect multiple attempts within a 10 second window, we don't even let them know if they get it right...

For more info, look at validatePasswordFlood() in LogInOut.php.

[BeberGold]

It's "Failed login threshold" under "Security" in the admin control panel.
It will redirect a user to the "Forgot password" page after a set amount of failed login attempts,
interrupting the normal login process.

Thank you for this.

In addition to that, there is password flood detection & control.

If we detect multiple attempts within a 10 second window, we don't even let them know if they get it right...

For more info, look at validatePasswordFlood() in LogInOut.php.

You are asking me to look at code. Is there a GUI option to adjust the time window of this feature?
If not, maybe it is something which could be added in future updates and therefore treated as a feature request?

[shawnb61]

You are asking me to look at code. Is there a GUI option to adjust the time window of this feature?
If not, maybe it is something which could be added in future updates and therefore treated as a feature request?

No, these are not user-controllable parameters at this time. 

Feel free to log a request in the Requests board:
https://www.simplemachines.org/community/index.php?board=3.0

[BeberGold]

No, these are not user-controllable parameters at this time. 

Feel free to log a request in the Requests board:
https://www.simplemachines.org/community/index.php?board=3.0

Good idea.

One more way would be to force people to use CAPTCHA either after a few consecutive login failures or when the source of the login attempt is suspicious.

[Kindred]

Captcha is useless. The bots have figured it out years ago