Better logging for failed attempts at repo migration - Brute force possible

[glitch003]

• Gitea version (or commit ref): 1.4.3
• Git version: 2.17.1
• Operating system: Ubuntu 16.04
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant

Description

A brute force attack on a user's password is possible using the migrate repo functionality. The standard advice for stopping brute force attacks on gitea is to use fail2ban (docs here: https://github.com/go-gitea/gitea/blob/master/docs/content/doc/usage/fail2ban-setup.md). However, the log message printed when an authentication attempt fails via "migrate repo" does not include the host / IP of the attacker, so it's not possible to set up fail2ban to ban the user.

The log message appears to be 2018/07/30 22:10:52 [...routers/repo/http.go:153 HTTP()] [E] invalid credentials

I think if we can have gitea log the IP, then we can add this error to the fail2ban filter in the gitea docs, and then fail2ban can handle this kind of login attempt as well.

Thanks!

[bobemoe]

This appears to be the same for a HTTP git clone or fetch. 2019/05/10 09:46:29 [...routers/repo/http.go:211 HTTP()] [E] invalid credentials and I'm thinking of exactly the same solution. I have fail2ban set up but the lack of IP in the log is the issue.