pluswerk / secure-login
+Pluswerk TYPO3 extension: Secure Login - brute-force security
Installs: 3 113
Dependents: 0
Suggesters: 0
Security: 0
Stars: 0
Watchers: 10
Forks: 2
Open Issues: 3
Type:typo3-cms-extension
Requires
- php: >=5.6.0
Requires (Dev)
Replaces
- secure_login: 1.0.0
- typo3-ter/secure-login: 1.0.0
- typo3-ter/secure_login: 1.0.0
This package is auto-updated.
Last update: 2022-03-01 15:33:13 UTC
README
+Pluswerk TYPO3 security extension: Secure Login
This extension checks frontend and backend logins for brute-force attacks. You can also detect and avoid brute-force attacks on other inputs, like serial number inputs or coupon code inputs.
Say goodbye to the try-out-hackers!
Advantages
- extendable
- small
- security improvement
- just install and use preset configuration
Identification of brute-force attacks
A brute-force attack is identified in accordance with the following rules:
- An IP tries out lots of different users
- An user tries out lots of different passwords
Is a brute-force attack identified, the attacking IP (in the first case) or user (in the second case) will be blocked over a specific period.
Installation
Install the TYPO3 extension via composer (recommended) or install the extension via TER (not recommended anymore).
Composer installation:
composer require pluswerk/secure-login
Default configuration
If no settings are made, the extension blocks users or IPs for two hours if they have more than 5 failed attempts in one hour.
Configuration (optional)
// Default configuration: overwrite this in you own localconf.php $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['secure_login'] = [ 'defaultBlockingConfiguration' => [ 'FE' => \Pluswerk\SecureLogin\Configuration\BlockingConfiguration::createConfig(), 'BE' => \Pluswerk\SecureLogin\Configuration\BlockingConfiguration::createConfig(), ], ];
Add the following configurations:
- maxFailedAttempts: Max amount of failed logins over specified time period 'timeRangeInSeconds'.
- timeRangeInSeconds: Time period (in seconds) over which 'maxFailedAttempts' are counted.
- blockingPeriodInSeconds: Time period (in seconds) over which the user or IP are blocked.
Example:
one user gets blocked for 'blockingPeriodInSeconds' seconds if he tries out 'maxFailedAttempts' wrong passwords in the time period of 'timeRangeInSeconds' seconds.
Extend Extension
Display security messages
The configured blocking is always active. To show security messages in the frontend add the following lines to your template:
<!-- use namespace --> <div xmlns:sl="http://typo3.org/ns/Pluswerk/SecureLogin/ViewHelpers"> <!-- content goes here --> <f:if condition="{sl:securityMessage()}"> <!-- fluid placeholder for security messages --> <p><sl:securityMessage/></p> </f:if> <!-- content goes here --> </div>
Log fail attempts
This sample logs failed logins:
$formInDatabase = $this->formRepository->findBySerialNumber($form->getSerialNumber()); if (count($formInDatabase) > 0) { /** @var \Pluswerk\SecureLogin\Configuration\BlockingConfiguration $blockingConfiguration */ $blockingConfiguration = \Pluswerk\SecureLogin\Configuration\BlockingConfiguration::createConfig(); /** @var AuthSecurityService $authSecurityService */ $authSecurityService = GeneralUtility::makeInstance(AuthSecurityService::class); $authSecurityService->logUserPasswordAuthenticationFailed($username, $password); }