diff --git a/auth_brute_force/README.rst b/auth_brute_force/README.rst index 98e68dbe6..a1ce4ce8a 100644 --- a/auth_brute_force/README.rst +++ b/auth_brute_force/README.rst @@ -1,22 +1,25 @@ .. image:: https://img.shields.io/badge/licence-AGPL--3-blue.svg :alt: License -============================================== -Authentication Tracking and Prevent Brut Force -============================================== +======================================================= +Authentication Tracking and Prevent Brute-force Attacks +======================================================= -This module register each request done by users trying to authenticate into +This module registers each request done by users trying to authenticate into Odoo. If the authentication fails, a counter is increased for the given remote -IP. After 10 attempts (or other quantity, depending on an ir.config_parameter), -Odoo will ban the remote IP and ignore new requests. - -Admin user have the possibility to unblock a banned IP. +IP. After after a defined number of attempts, Odoo will ban the remote IP and +ignore new requests. +This module applies [security through obscurity] +(https://en.wikipedia.org/wiki/Security_through_obscurity): +When a user is banned, the request is now considered as an attack. So, the UI +will **not** indicate to the user that his IP is banned and the regular message +'Wrong login/password' is displayed. This module realizes a call to a web API (http://ip-api.com) to try to have extra informations about remote IP. -Note and Warning ----------------- +Known issue / Roadmap +--------------------- The ID used to identify a remote request is the IP provided in the request (key 'REMOTE_ADDR'). Depending of server and / or user network configuration, the idenfication @@ -27,6 +30,18 @@ of the user can be wrong, and mainly in the following cases: * If some users are behind the same Internet Service Provider, if a user is banned, all the other users will be banned to; +Configuration +------------- + +Once installed, you can change the ir.config_parameter value for the key +'auth_brute_force.max_attempt_qty' (10 by default) that define the max number +of attempts allowed before the user was banned. + +Usage +----- + +Admin user have the possibility to unblock a banned IP. + Logging ------- @@ -47,11 +62,11 @@ Screenshot **List of Attempts** -.. image:: /auth_brut_force/static/description/screenshot_attempts_list.png +.. image:: /auth_brute_force/static/description/screenshot_attempts_list.png **Detail of a banned IP** -.. image:: /auth_brut_force/static/description/screenshot_custom_ban.png +.. image:: /auth_brute_force/static/description/screenshot_custom_ban.png Usage @@ -73,7 +88,7 @@ Bug Tracker Bugs are tracked on `GitHub Issues `_. In case of trouble, please check there if your issue has already been reported. If you spotted it first, help us smashing it by providing a detailed and welcomed feedback -`here `_. +`here `_. Credits ======= diff --git a/auth_brute_force/__openerp__.py b/auth_brute_force/__openerp__.py index 07424f7a3..e3dbf4220 100644 --- a/auth_brute_force/__openerp__.py +++ b/auth_brute_force/__openerp__.py @@ -1,7 +1,7 @@ # -*- encoding: utf-8 -*- ############################################################################## # -# Authentification - Track And Prevent Brut Force module for Odoo +# Authentification - Track And Prevent Brute-force Attack module for Odoo # Copyright (C) 2015-Today GRAP (http://www.grap.coop) # @author Sylvain LE GAL (https://twitter.com/legalsylvain) # @@ -21,10 +21,10 @@ ############################################################################## { - 'name': 'Authentification - Track And Prevent Brut Force', + 'name': 'Authentification - Brute-force Attack', 'version': '8.0.1.0.0', 'category': 'base', - 'summary': "Authentication Tracking and Prevent Brut Force", + 'summary': "Authentication Tracking and Prevent Brute-force Attack", 'author': "GRAP,Odoo Community Association (OCA)", 'website': 'http://www.grap.coop', 'license': 'AGPL-3', diff --git a/auth_brute_force/controllers/controllers.py b/auth_brute_force/controllers/controllers.py index 815030960..5d58a0cfd 100644 --- a/auth_brute_force/controllers/controllers.py +++ b/auth_brute_force/controllers/controllers.py @@ -1,7 +1,7 @@ # -*- encoding: utf-8 -*- ############################################################################## # -# Authentification - Track And Prevent Brut Force module for Odoo +# Authentification - Track And Prevent Brute-force Attack module for Odoo # Copyright (C) 2015-Today GRAP (http://www.grap.coop) # @author Sylvain LE GAL (https://twitter.com/legalsylvain) # diff --git a/auth_brute_force/data/ir_config_parameter.xml b/auth_brute_force/data/ir_config_parameter.xml index 63a904623..571a1d696 100644 --- a/auth_brute_force/data/ir_config_parameter.xml +++ b/auth_brute_force/data/ir_config_parameter.xml @@ -1,6 +1,6 @@ - + diff --git a/auth_brute_force/models/res_authentication_attempt.py b/auth_brute_force/models/res_authentication_attempt.py index cb2718708..0708a621b 100644 --- a/auth_brute_force/models/res_authentication_attempt.py +++ b/auth_brute_force/models/res_authentication_attempt.py @@ -1,7 +1,7 @@ # -*- encoding: utf-8 -*- ############################################################################## # -# Authentification - Track And Prevent Brut Force module for Odoo +# Authentification - Track And Prevent Brute-force Attack module for Odoo # Copyright (C) 2015-Today GRAP (http://www.grap.coop) # @author Sylvain LE GAL (https://twitter.com/legalsylvain) # diff --git a/auth_brute_force/models/res_banned_remote.py b/auth_brute_force/models/res_banned_remote.py index ed9a6ffee..aca256943 100644 --- a/auth_brute_force/models/res_banned_remote.py +++ b/auth_brute_force/models/res_banned_remote.py @@ -1,7 +1,7 @@ # -*- encoding: utf-8 -*- ############################################################################## # -# Authentification - Track And Prevent Brut Force module for Odoo +# Authentification - Track And Prevent Brute-force Attack module for Odoo # Copyright (C) 2015-Today GRAP (http://www.grap.coop) # @author Sylvain LE GAL (https://twitter.com/legalsylvain) # diff --git a/auth_brute_force/views/action.xml b/auth_brute_force/views/action.xml index 56105d2f0..7c8c5f44d 100644 --- a/auth_brute_force/views/action.xml +++ b/auth_brute_force/views/action.xml @@ -1,6 +1,6 @@ - + diff --git a/auth_brute_force/views/menu.xml b/auth_brute_force/views/menu.xml index e2f8f5e66..6e46f1ac3 100644 --- a/auth_brute_force/views/menu.xml +++ b/auth_brute_force/views/menu.xml @@ -1,6 +1,6 @@ - + diff --git a/auth_brute_force/views/view.xml b/auth_brute_force/views/view.xml index 074d8506f..48e1b0483 100644 --- a/auth_brute_force/views/view.xml +++ b/auth_brute_force/views/view.xml @@ -1,6 +1,6 @@ - +