[MIG] auth_brute_force: Migration to 10.0 by chienandalu · Pull Request #877 · OCA/server-tools

chienandalu · 2017-06-26T14:29:52Z

Tracks Authentication Attempts and Prevents Brute-force Attacks

This module registers each request done by users trying to authenticate into
Odoo. If the authentication fails, a counter is increased for the given remote
IP. After a defined number of attempts, Odoo will ban the remote IP and
ignore new requests.

cc @Tecnativa

pedrobaeza

Tried also on runbot with a non correct behavior:

Login n times until I reach the limit.
On last attempt, it gets me to an incorrect "Internal Server Error", and no banned remote is written.
Then, I'm able to login again with correct credentials.

pedrobaeza · 2017-06-28T17:23:22Z


 * Authentication failed from remote '127.0.0.1'. Login tried : 'admin'.
-  Attempt 1 / 10.
+Attempt 1 / 10.


Why do you remove indentation? This provokes an incorrect RST syntax. It was correct as it was.

Seem like my editor tried somehow to re-indent it...

pedrobaeza · 2017-06-28T17:23:47Z

+Known issues / Roadmap
+======================
+
+The ID used to identify a remote request is the IP provided in the request


Put * and indent the rest of the lines.

pedrobaeza · 2017-06-28T17:23:53Z

+of the user can be wrong, and mainly in the following cases:
+
+* if the Odoo server is behind an Apache / NGinx proxy without redirection,
+all the request will be have the value '127.0.0.1' for the REMOTE_ADDR key;


Indent the line

pedrobaeza · 2017-06-28T17:23:58Z

+* if the Odoo server is behind an Apache / NGinx proxy without redirection,
+all the request will be have the value '127.0.0.1' for the REMOTE_ADDR key;
+* If some users are behind the same Internet Service Provider, if a user is
+banned, all the other users will be banned too;


Indent the line

pedrobaeza · 2017-06-28T17:24:17Z

+    'category': 'Tools',
+    'summary': "Tracks Authentication Attempts and Prevents Brute-force"
+               " Attacks module",
+    'author': "GRAP,Odoo Community Association (OCA)",


Add Tecnativa here

pedrobaeza · 2017-06-28T17:25:18Z

-<openerp>
+<!-- Copyright 2015 GRAP -Sylvain LE GAL
+     License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). -->
+<odoo>


Put directly <odoo noupdate="1">

pedrobaeza · 2017-06-28T17:33:05Z

+                            "Authentication failed from remote '%s'. "
+                            "The remote has been banned. Login tried : '%s'"
+                            "." % (remote, request.params['login']))
+                        banned_remote_obj.create(cursor, SUPERUSER_ID, {


You haven't converted this to new API (banned_remote_obj.sudo().create({ ... }))

Garamotte · 2017-06-28T17:39:17Z

@@ -0,0 +1,77 @@
+# -*- coding: utf-8 -*-


This file is usually named main.py.

Garamotte · 2017-06-28T17:40:27Z

+                attempt_obj = env['res.authentication.attempt']
+                banned_remote_obj = env['res.banned.remote']
+                # Get Settings
+                max_attempts_qty = int(config_obj.search_read(


Use config_obj.get_param('auth_brute_force.max_attempt_qty') instead of search_read.

Garamotte · 2017-06-28T17:41:49Z

+                        request.session.db, request.params['login'],
+                        request.params['password'])
+                # Log attempt
+                cursor.commit()


There is a commit just after the next instruction, is this commit really needed ?

Yes. It seems that it's not neccesary.

Garamotte · 2017-06-28T17:43:07Z

+<!-- Copyright 2015 GRAP -Sylvain LE GAL
+     License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). -->
+<odoo>
+    <data noupdate="1">


Remove the data node and include the noupdate attribute in the odoo node.

Garamotte · 2017-06-28T17:45:55Z

+        string='Description', compute='_compute_description', store=True)
+
+    ban_date = fields.Datetime(
+        string='Ban Date', required=True, default=_default_ban_date)


default=fields.Datetime.now.

Garamotte · 2017-06-28T17:48:02Z

+    def _compute_attempt_ids(self):
+        for item in self:
+            attempt_obj = self.env['res.authentication.attempt']
+            item.attempt_ids = attempt_obj.search_last_failed(item.remote).ids


You can remove the trailing .ids, Odoo allows you to assign a recordset.

chienandalu · 2017-06-29T11:04:17Z

@pedrobaeza @sylvain-garancher I coded your suggestions and tested functionally in local.

Merge 15.0 into 15.0.project_MI_465

yajo added the needs review label Jun 27, 2017

yajo added this to the 10.0 milestone Jun 27, 2017

pedrobaeza requested changes Jun 28, 2017

View reviewed changes

pedrobaeza reviewed Jun 28, 2017

View reviewed changes

Garamotte suggested changes Jun 28, 2017

View reviewed changes

pedrobaeza approved these changes Jun 29, 2017

View reviewed changes

chienandalu force-pushed the 10.0-mig-auth_brute_force branch from 5ac1662 to 18f4dee Compare June 29, 2017 13:35

Garamotte approved these changes Jun 30, 2017

View reviewed changes

legalsylvain and others added 3 commits July 29, 2017 14:24

rename module;

f186225

OCA Transbot updated translations from Transifex

92c286b

[MIG] auth_brute_force: Migration to 10.0

e91bdfb

pedrobaeza force-pushed the 10.0-mig-auth_brute_force branch from 18f4dee to e91bdfb Compare July 29, 2017 12:24

pedrobaeza merged commit 3a44e06 into OCA:10.0 Jul 29, 2017

pedrobaeza deleted the 10.0-mig-auth_brute_force branch July 29, 2017 12:53

pedrobaeza mentioned this pull request Jul 29, 2017

Migration to version 10.0 #565

Closed

63 tasks

yajo pushed a commit to Tecnativa/server-auth that referenced this pull request May 22, 2018

[MIG] auth_brute_force: Migration to 10.0 (OCA/server-tools#877)

643e743

nikunjantala pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Sep 5, 2022

[MIG] auth_brute_force: Migration to 10.0 (OCA/server-tools#877)

6f0018f

nikunjantala pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Sep 28, 2022

[MIG] auth_brute_force: Migration to 10.0 (OCA/server-tools#877)

9d9c0af

nikunjantala pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Oct 10, 2022

[MIG] auth_brute_force: Migration to 10.0 (OCA/server-tools#877)

a69c259

dsolanki-initos pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Nov 30, 2022

[MIG] auth_brute_force: Migration to 10.0 (OCA/server-tools#877)

bb3f3ba

SiesslPhillip pushed a commit to grueneerde/OCA-server-tools that referenced this pull request Nov 20, 2024

Merge pull request OCA#877 from brain-tec/15.0

8683082

Merge 15.0 into 15.0.project_MI_465

hitesh-erpharbor pushed a commit to Nitrokey/odoo-server-auth that referenced this pull request Nov 26, 2025

auth_brute_force: Migration to 10.0 (OCA/server-tools#877)

af5a6dd

Uh oh!

Uh oh!

Conversation

chienandalu commented Jun 26, 2017

Tracks Authentication Attempts and Prevents Brute-force Attacks

Uh oh!

pedrobaeza left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chienandalu commented Jun 29, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants