You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

118 lines
4.0 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. .. image:: https://img.shields.io/badge/licence-AGPL--3-blue.svg
  2. :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
  3. :alt: License: AGPL-3
  4. ===============================================================
  5. Tracks Authentication Attempts and Prevents Brute-force Attacks
  6. ===============================================================
  7. This module registers each request done by users trying to authenticate into
  8. Odoo. If the authentication fails, a counter is increased for the given remote
  9. IP. After a defined number of attempts, Odoo will ban the remote IP and
  10. ignore new requests.
  11. This module applies security through obscurity
  12. (https://en.wikipedia.org/wiki/Security_through_obscurity),
  13. When a user is banned, the request is now considered as an attack. So, the UI
  14. will **not** indicate to the user that his IP is banned and the regular message
  15. 'Wrong login/password' is displayed.
  16. This module realizes a call to a web API (http://ip-api.com) to try to have
  17. extra information about remote IP.
  18. Configuration
  19. =============
  20. You can use these configuration parameters that control this addon behavior:
  21. * ``auth_brute_force.whitelist_remotes`` is a comma-separated list of
  22. whitelisted IPs. Failures from these remotes are ignored.
  23. * ``auth_brute_force.max_by_ip`` defaults to 50, and indicates the maximum
  24. successive failures allowed for an IP. After hitting the limit, the IP gets
  25. banned.
  26. * ``auth_brute_force.max_by_ip_user`` defaults to 10, and indicates the
  27. maximum successive failures allowed for any IP and user combination.
  28. After hitting the limit, that user and IP combination is banned.
  29. Usage
  30. =====
  31. Admin user have the possibility to unblock a banned IP.
  32. Logging
  33. -------
  34. This module generates some WARNING logs, in the following cases:
  35. * When the IP limit is reached: *Authentication failed from remote 'x.x.x.x'.
  36. The remote has been banned. Login tried: xxxx.*
  37. * When the IP+user combination limit is reached:
  38. *Authentication failed from remote 'x.x.x.x'.
  39. The remote and login combination has been banned. Login tried: xxxx.*
  40. Screenshot
  41. ----------
  42. **List of Attempts**
  43. .. image:: /auth_brute_force/static/description/screenshot_attempts_list.png
  44. .. image:: https://odoo-community.org/website/image/ir.attachment/5784_f2813bd/datas
  45. :alt: Try me on Runbot
  46. :target: https://runbot.odoo-community.org/runbot/149/10.0
  47. For further information, please visit:
  48. * https://www.odoo.com/forum/help-1
  49. Known issues / Roadmap
  50. ======================
  51. * Remove 🐒 patch for https://github.com/odoo/odoo/issues/24183 in v12.
  52. * Depending of server and / or user network configuration, the idenfication
  53. of the user can be wrong, and mainly in the following cases:
  54. * If the Odoo server is behind an Apache / NGinx proxy and it is not properly
  55. configured, all requests will use the same IP address. Blocking such IP
  56. could render Odoo unusable for all users! **Make sure your logs output the
  57. correct IP for werkzeug traffic before installing this addon.**
  58. * The IP metadata retrieval should use a better system. `See details here
  59. <https://github.com/OCA/server-tools/pull/1219/files#r187014504>`_.
  60. Bug Tracker
  61. ===========
  62. Bugs are tracked on `GitHub Issues
  63. <https://github.com/OCA/server-tools/issues>`_. In case of trouble, please
  64. check there if your issue has already been reported. If you spotted it first,
  65. help us smash it by providing detailed and welcomed feedback.
  66. Credits
  67. =======
  68. Contributors
  69. ------------
  70. * Sylvain LE GAL (https://twitter.com/legalsylvain)
  71. * David Vidal <david.vidal@tecnativa.com>
  72. * Jairo Llopis <jairo.llopis@tecnativa.com>
  73. Maintainer
  74. ----------
  75. .. image:: https://odoo-community.org/logo.png
  76. :alt: Odoo Community Association
  77. :target: https://odoo-community.org
  78. This module is maintained by the OCA.
  79. OCA, or the Odoo Community Association, is a nonprofit organization whose
  80. mission is to support the collaborative development of Odoo features and
  81. promote its widespread use.
  82. To contribute to this module, please visit https://odoo-community.org.