8.0 add auth track and prevent brut force #262

legalsylvain · 2015-09-26T00:49:46Z

Add a module to limit brut force attack on authentication.
Define an ir.config_parameter that mentions max attempts.
Once this maximum reached, the remote user will be blocked. (by IP).

See readme file for the whole description.

Thanks for your review.

pedrobaeza · 2015-09-26T00:53:12Z

Very interesting module. I think the name can be shorten to auth_brute_force, because we don't need to put the full title on the name 😉

pedrobaeza · 2015-09-26T00:54:01Z

auth_track_and_prevent_brut_force/README.rst

s/Brut Force/Brut-force attacks

pedrobaeza · 2015-09-26T00:57:06Z

auth_track_and_prevent_brut_force/README.rst

Does that call delay the login? It should be then put on Known issues, or prepare an asynchronous call for that

The call is done when the user is banned. So it doesn't delay the login...

pedrobaeza · 2015-09-26T01:00:52Z

Good icon! Do you have the SVG version? Can you remove blank background from it and let it transparent?

pedrobaeza · 2015-09-26T01:01:31Z

Please put also icon reference on credits (ensuring it can be used - CC license?)

pedrobaeza · 2015-09-26T01:02:47Z

Sorry for bothering you again. In last commit you have changed references to auth_brut_force instead of auth_brute_force

legalsylvain · 2015-09-26T01:24:00Z

hi @pedrobaeza ! Thanks for your review !

About what odoo returns, I updated the description. This point is pretty important, the module don't change the behaviour. Odoo will simply indicates that the combination is bad (even if the attacker finally find the good combination of login / password)
About logging, log can be used by a system that parse logs, or by sentry system, when table will not. (or not so easy). But I can understand that it is redundant.
About the image, I have to fix it;

I changed the rest according to your other comments.

elicoidal · 2015-09-26T01:29:03Z

auth_brute_force/__openerp__.py

Suggestion:
Tracks Authentication Attempts and Prevents Brute-force Attacks
or
Authentication Tracking and Brute-force Attacks Prevention
=> 2 verbs or 2 nouns. I prefer the first one.

…ithub.com/grap/server-tools into 8.0_ADD_auth_track_and_prevent_brut_force

pedrobaeza · 2015-09-27T18:11:56Z

One minor remark:

access_res_authentication_attempt,access_res_authentication_attempt,model_res_authentication_attempt,,1,0,0,0

The rest seems 👍 (code review)

legalsylvain · 2015-09-28T09:08:34Z

Thanks for your review, @pedrobaeza.
I added security file, giving read access to all users, and write / Delete access to "config / settting" members. (admin, by default).
Kind regards.

max3903 · 2016-02-10T19:39:45Z

👍

…_force [ADD] auth track and prevent brut force

rafaelbn · 2016-07-23T12:40:11Z

Hi @legalsylvain , I would like to ash about this module after reading README. Does it notify to any user in Odoo to take care about? (notify -> email). Thanks!

dreispt · 2016-07-28T07:37:31Z

auth_brute_force/README.rst

+* if the Odoo server is behind an Apache / NGinx proxy without redirection,
+  all the request will be have the value '127.0.0.1' for the REMOTE_ADDR key;
+* If some users are behind the same Internet Service Provider, if a user is
+  banned, all the other users will be banned too;


But this is expected to be the usual case, isn't it?
I'm a little out of step here, be shouldn't we also look into X-Forwarded-For?

alexis-via · 2017-06-23T13:47:12Z

auth_brute_force/security/ir_model_access.yml

+    model_id: model_res_authentication_attempt
+    name: Authentication Attempt All Users
+    perm_read: true
+


I think it's a kind of privacy flaw to allow all users to read res.authentication.attempt. And it's not needed to give that right to all users.

You're probably right. (the same for model_res_banned_remote I guess)
feel free to propose a PR, I'll review it quickly. (you can too replace by xml, as yml is now deprecated)

Syncing from upstream OCA/server-tools (10.0)

legalsylvain added 3 commits September 26, 2015 02:44

[ADD] new module 'auth_track_and_prevent_brut_force' ;

b8fdab8

[FIX] typo

35ff728

[FIX] description;

da906a2

pedrobaeza reviewed Sep 26, 2015
View reviewed changes

auth_track_and_prevent_brut_force/README.rst Outdated

Copy link

Member

pedrobaeza Sep 26, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/Brut Force/Brut-force attacks

[REF] rename module;

a3a25ea

pedrobaeza reviewed Sep 26, 2015
View reviewed changes

legalsylvain added 2 commits September 26, 2015 03:14

[FIX] incorrect name for the module;

6f89d2c

[REF] description;

298803e

legalsylvain added the needs review label Sep 26, 2015

legalsylvain added this to the 8.0 milestone Sep 26, 2015

[FIX] description;

18c6980

elicoidal reviewed Sep 26, 2015
View reviewed changes

legalsylvain added 3 commits September 26, 2015 03:38

[IMP] module name

1779d51

Merge branch '8.0_ADD_auth_track_and_prevent_brut_force' of https://g…

987e1be

…ithub.com/grap/server-tools into 8.0_ADD_auth_track_and_prevent_brut_force

[FIX] icon

0d8bc55

legalsylvain added 2 commits September 28, 2015 11:04

[REF] controller algorithm, merge search and browse request;

23b1c8d

[ADD] security file;

9e651f9

legalsylvain added 2 commits September 28, 2015 11:05

[REF] remove useless field 'name' and fix description;

fea6fe0

[ADD] graph view on attempts;

088ea52

max3903 pushed a commit that referenced this pull request Feb 10, 2016

Merge pull request #262 from grap/8.0_ADD_auth_track_and_prevent_brut…

b403942

…_force [ADD] auth track and prevent brut force

max3903 merged commit b403942 into OCA:8.0 Feb 10, 2016

yvaucher removed the needs review label Feb 10, 2016

dreispt reviewed Jul 28, 2016
View reviewed changes

alexis-via reviewed Jun 23, 2017

View reviewed changes

yajo pushed a commit to Tecnativa/server-auth that referenced this pull request May 22, 2018

rename module; (OCA/server-tools#262)

25478c6

nikunjantala pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Sep 5, 2022

rename module; (OCA/server-tools#262)

9580a33

nikunjantala pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Sep 28, 2022

rename module; (OCA/server-tools#262)

08894f7

nikunjantala pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Oct 10, 2022

rename module; (OCA/server-tools#262)

22cce1d

dsolanki-initos pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Nov 30, 2022

rename module; (OCA/server-tools#262)

69b3e6b

SiesslPhillip pushed a commit to grueneerde/OCA-server-tools that referenced this pull request Nov 20, 2024

Merge pull request OCA#262 from OCA/10.0

7b281e1

Syncing from upstream OCA/server-tools (10.0)

hitesh-erpharbor pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Nov 26, 2025

rename module; (OCA/server-tools#262)

951bc3d

Uh oh!

8.0 add auth track and prevent brut force #262

8.0 add auth track and prevent brut force #262

Uh oh!

Conversation

legalsylvain commented Sep 26, 2015

Uh oh!

pedrobaeza commented Sep 26, 2015

Uh oh!

pedrobaeza Sep 26, 2015

Choose a reason for hiding this comment

Uh oh!

pedrobaeza Sep 26, 2015

Choose a reason for hiding this comment

Uh oh!

legalsylvain Sep 26, 2015

Choose a reason for hiding this comment

Uh oh!

pedrobaeza commented Sep 26, 2015

Uh oh!

pedrobaeza commented Sep 26, 2015

Uh oh!

pedrobaeza commented Sep 26, 2015

Uh oh!

legalsylvain commented Sep 26, 2015

Uh oh!

elicoidal Sep 26, 2015

Choose a reason for hiding this comment

Uh oh!

pedrobaeza commented Sep 27, 2015

Uh oh!

legalsylvain commented Sep 28, 2015

Uh oh!

max3903 commented Feb 10, 2016

Uh oh!

rafaelbn commented Jul 23, 2016

Uh oh!

dreispt Jul 28, 2016

Choose a reason for hiding this comment

Uh oh!

alexis-via Jun 23, 2017

Choose a reason for hiding this comment

Uh oh!

legalsylvain Jun 23, 2017

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants