Plugin for block ip?

[itiloo]

Hi Rejetto:

do you have any plugin about block ip after x number of error logins?.

Thanks.

[rejetto]

yes, it's installed and enabled by default.
it's called "antibrute"

[itiloo]

Yes, but that plugin not block ip, true?

[rejetto]

right, it doesn't.
would it be good?

[itiloo]

How anti-ddos plugin but not with request, with logins.

[rejetto]

seems legit, i will consider this for the near future, like in 0.53 .
nice thing is that, being it a plugin, a programmer could make it without waiting for me.

[PH5HP]

Hi Rejetto,

Maybe not DDOS, but someone from China tries something almost every day. Screenshot below.

Kind regards,
Henk - PH5HP - fileserver.ph5hp.nl

[rejetto]

that's why i asked.
look, here we are discussing about login attempts, and your screenshot shows none.
when i'll add the feature discussed above, these requests won't be blocked (unless they are not preceeded by login attempts).
you have first to decide what is the rule you want to apply. Can't you just block that ip?

[PH5HP]

Hi,

I understand. I had forgotten this was all about log in attemps. Sorry.I thought it was also about this kind of misbehaviour from a user. What is he trying to do or what is he doing to generate this messages? This happens on a daily basis. Only from China.

Kind regards,
Henk - PH5HP - fileserver.ph5hp.nl

[rejetto]

he is making http requests with some software that's not a browser.
its purpose, i don't know. I can't infer anything from your screenshot, but i also cannot see anything harmful.
http is not only for browser, you can make requests even from the command line.
did you block that ip?

[PH5HP]

Hi Rejetto,

TNX for the swift reply. Not yet, but I am going to. :-)

Kind regards,
Henk - PH5HP - fileserver.ph5hp.nl

[itiloo]

Ok, perfect, thank you so much

[rejetto]

you'll find this in latest version
https://github.com/rejetto/hfs/releases/tag/v0.53.0-alpha1

[oromanobr]

hi. I accidentally deleted the anti-brute plugin. How do I reinstall it?

[rejetto]

@oromanobr create the folder you deleted, and download only this file in it https://github.com/rejetto/hfs/blob/main/plugins/antibrute/plugin.js

[ZIKVLD]

+
Plugins broken:
download-counter 5.11
file-icons by rejetto 2.3
thumbnails by rejetto 3.12
Perhaps something else

[rejetto]

thanks for reporting, and sorry for that.
i'm removing this version

[itiloo]

you'll find this in latest version https://github.com/rejetto/hfs/releases/tag/v0.53.0-alpha1

Thank you so much Rejetto for your work.

I have tested the plugin and it blocks the IP correctly after the specified attempts. I have 2 doubts.

1.-Is each attempt for that IP cumulative daily and at the end of the day is that counter reset? Or is the attempt counter not cleared at any time and continue accumulating for life until it reaches that specified number? .
2.-To manually unblock the IP, is it necessary to go to config.yaml and delete the corresponding line?

Thank you very much Rejetto.

[itiloo]

I see better option block ip if it makes x failed attempts in the time space of x seconds, but you decide.

[rejetto]

you need something different than 24 hours?

[itiloo]

I understand that whoever wants to try to access by brute force will automate, for example, 5 attempts every 20 seconds, so it could be good to have the option to block IP if, for example, 5 failed attempts are made in the space of 20 seconds.

[rejetto]

you are forgetting that this plugin is delaying you, so you cannot do 5 attempts in 20 seconds.
with default settings it will take 50 seconds for 5 attempts, even automated.

[itiloo]

True, sorry.