IP addresses to log if login fails

[BeckeBauer]

Is there a way to record IP addresses in the prod.log file in case that login fails due to invalid credentials?

I would like to use fail2ban to block such IPs after a given number of invalid trials in order to protect agaist unauthorised access.

[kevinpapst]

https://www.nomisoft.co.uk/articles/symfony-fail2ban-ip-blocking

[BeckeBauer]

Thank you for the link. I tried my best to implement the code but tremendously failed. It starts that I have no clue in which directory to place the services.yml
Also, I modified the existing AuthenticationListener.php unter fos/user-bundle/EventListener but am unsure if this is the right file.
Any hint would be appreciated...

[kevinpapst]

https://github.com/kevinpapst/kimai2/blob/master/config/services.yaml

[BeckeBauer]

Thank you, it worked!
(your link does not refer to the the service.yaml - despite its name - but the location kimai2/config was the right hint).
If required, I can describe the steps to log the IP addresses!?

[kevinpapst]

Does it work for you? Then yes, please share it! I'd love to make a documentation page for it.

[kevinpapst]

You need to add 3 ` before and after the code (and no space in the beginning of the line):
https://help.github.com/en/articles/basic-writing-and-formatting-syntax#quoting-code

[BeckeBauer]

1. Create a PHP file with the following content:

<?php

namespace FOS\UserBundle\EventListener;

use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\RequestStack;

class FailedLoginListener
{

    /**
     * @var LoggerInterface
     */
    private $logger;

    /**
     * @var RequestStack
     */
    private $request;

    /**
     * @param LoggerInterface $logger
     * @param RequestStack $request
     */
    public function __construct(LoggerInterface $logger, RequestStack $request)
    {
        $this->logger = $logger;
        $this->request = $request;
    }

    /**
     * onAuthenticationFailure
     */
    public function onAuthenticationFailure()
    {
        $ipAddress = $this->request->getCurrentRequest()->getClientIp();
        $this->logger->error('Authentication failed for IP: ' . $ipAddress);
    }

}

2. Save it to kimai2\vendor\friendsofsymfony\user-bundle\EventListener as FailedLoginListener.php (or give it a different name if you do not like it and rename the class accordingly)

3. Add the following code to service.yaml in kimai2\config

    # ================================================================================
    # Logging IP Addresses on Failed Authorisation
    # ================================================================================   
    app.security.authentication_event_listener:
        class: FOS\UserBundle\EventListener\FailedLoginListener
        arguments: ["@logger","@request_stack"]
        tags:
            - { name: kernel.event_listener, event: security.authentication.failure, method: onAuthenticationFailure }

3. Run
   composer install --no-dev --optimize-autoloader
   bin/console cache:clear --env=prod
   bin/console cache:warmup --env=prod

4. To test: use wrong login credentials and check your prod.log

[kevinpapst]

Ok, you have a working solution for now, great & thanks for sharing!

Then let me see what I can make of that. This implementation is far from being ideal ;-)

[BeckeBauer]

one remark: the following expression to be used in the filter for fail2ban is working:

failregex = Authentication failed for IP: <HOST>

[kevinpapst]

Hey @BeckeBauer , do you want to test the new Fail2Ban bundle?
See https://www.kimai.org/store/fail2ban-bundle.html
Feedback can be left here: https://github.com/Keleo/Fail2BanBundle
The log format and file changed... but it makes your change update safe.

[BeckeBauer]

I will do tonight

[kevinpapst]

Follow up: Keleo/Fail2BanBundle#1

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. If you use Kimai on a daily basis, please consider donating to support further development of Kimai.