#20495: add login failure events to django.security logger
--------------------------------------+------------------------------------
Reporter: ptone | Owner: nobody
Type: Cleanup/optimization | Status: closed
Component: contrib.auth | Version: master
Severity: Normal | Resolution: wontfix
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Comment (by mallyvai):
The ticket @jacobian put up here:
https://code.djangoproject.com/ticket/26629 has some more rationale on why
logging failed attempts by default is a good idea.
The main situation I'm worried about is being aware of targeted brute-
forcing of admin user's credentials, esp. with known email addresses, on
the admin panel.
Here's the specific case:
1. Someone is attempting to brute-force a known admin's email address via
the panel
2. I see Sentry lighting up with multiple security errors
3. I can decide what action to take for that IP address, user account
[temporarily downgrade perms for it? ban the IP? etc]
With regards to what to log:
1. Logging the password seems like a bad idea.
2. But logging the username and privilege level of the user seems like a
good one. At the very least the PK of the user object under consideration,
if not the username - something so I know what to try and protect.
3. Logging the IP address of the host attempting any failed login is
definitely a good idea
4. NIST guidelines also describe how VPNs log special properties of the
failed login attempt:
http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf
> VPN systems typically log successful and failed login attempts, as well
as the dates and times each user connected and disconnected, and the
amount of data sent and received in each user session. VPN systems that
support granular access control, such as many Secure Sockets Layer (SSL)
VPNs, may log detailed information about the use of resources.
If there's additional metadata about the login attempt that can be
helpful, it may make sense to do that as well (cookies? browser version?
user-agent? not sure.)
--
Ticket URL: <https://code.djangoproject.com/ticket/20495#comment:18>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/063.e434118e32b0b95f8b2010519bd0254c%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
