fail2ban for SimpleLogin

[DANgerous25]

Hi there, I'd like to set up some logging and ultimately fail2ban to look at failed login attempts and brute force attacks. Any idea as to how I can do this?

Looking at the sl-app logs, there is a log entry for a successful login but there doesn't seem to be one for a failed login, unless I'm looking in the wrong place or am looking for the wrong thing.

Successful login:

docker logs sl-app

2022-09-26 15:44:32,245 - SL - DEBUG - 9 - "/code/app/auth/views/login_utils.py:32" - after_login() -  - log user <User 70  [email protected]> in
2022-09-26 15:44:32,246 - SL - DEBUG - 9 - "/code/app/auth/views/login_utils.py:40" - after_login() -  - redirect user to dashboard
2022-09-26 15:44:32,246 - SL - DEBUG - 9 - "/code/server.py:267" - after_request() -  - 10.0.0.1 POST /auth/login ImmutableMultiDict([]) 302, takes 0.2759366035461426
2022-09-26 15:44:32,361 - SL - DEBUG - 9 - "/code/server.py:267" - after_request() -  - 10.0.0.1 GET /dashboard/ ImmutableMultiDict([]) 200, takes 0.10425591468811035
2022-09-26 15:44:32,441 - SL - DEBUG - 10 - "/code/server.py:267" - after_request() -  - 10.0.0.1 GET /api/notifications ImmutableMultiDict([('page', '0')]) 200, takes 0.017250537872314453
2022-09-26 15:44:47,727 - SL - DEBUG - 9 - "/code/server.py:267" - after_request() -  - 10.0.0.1 GET /auth/logout ImmutableMultiDict([]) 302, takes 0.0053784847259521484
2022-09-26 15:44:47,739 - SL - DEBUG - 9 - "/code/server.py:267" - after_request() -  - 10.0.0.1 GET /auth/login ImmutableMultiDict([]) 200, takes 0.0019276142120361328
2022-09-26 15:45:08,508 - SL - DEBUG - 10 - "/code/server.py:267" - after_request() -  - 10.0.0.1 POST /auth/login ImmutableMultiDict([]) 200, takes 0.010792016983032227

Unsuccessful login:

docker logs sl-app

2022-09-26 15:49:59,120 - SL - DEBUG - 9 - "/code/server.py:267" - after_request() -  - 10.0.0.1 GET /auth/logout ImmutableMultiDict([]) 302, takes 0.002444028854370117
2022-09-26 15:49:59,149 - SL - DEBUG - 9 - "/code/server.py:267" - after_request() -  - 10.0.0.1 GET /auth/login ImmutableMultiDict([]) 200, takes 0.006292819976806641
2022-09-26 15:50:34,668 - SL - DEBUG - 9 - "/code/server.py:267" - after_request() -  - 10.0.0.1 POST /auth/login ImmutableMultiDict([]) 200, takes 0.33701562881469727

Any idea how I can get the IP address of the failed login? Even better, any idea how to make fail2ban work for this?

[nguyenkims]

@DANgerous25 we don't use fail2ban actually. There's a rate limiting system in SL that would prevent these attacks though.

[DANgerous25]

Thank you, but is there any way for me to tell who has failed to log in and when?

[nguyenkims]

I checked and in the current version, we don't log the failed login attempt details. You can create a PR to add this but after the PR is merged, you would need to wait for the next self-hosted version or running our SaaS latest version (which is the app-ci/... Docker image)