ramackri opened a new pull request, #1102: URL: https://github.com/apache/ranger/pull/1102
## Summary - Extends RANGER-5690 / PR #1080 with **account-associated failed-login tracking** in addition to existing per-source-IP throttling. - Failed attempts against the same OS username now accumulate across all source IPs; once the account threshold is reached, further attempts for that account are rejected before the OS credential validator runs. - Adds separate configurable account lockout policy (threshold, observation window, lockout duration) per OWASP Authentication Cheat Sheet guidance. - Account lockout is enabled by default but can be disabled via `ranger.usersync.unixauth.account.lockout.enabled=false`. ## Background PR #1080 added per-IP rate limiting only. Distributed guessing against a single account from many source addresses could still reach up to `max.failed.attempts × N` validator invocations per window. This change closes that application-layer gap. ## Changes | File | Change | |------|--------| | `LoginAttemptTracker.java` | Dual IP + account counters via internal `AttemptCounter` | | `PasswordValidator.java` | Parse username before lockout check; record/check both IP and account | | `UnixAuthenticationService.java` | Load account lockout config properties | | `ranger-ugsync-default.xml` | New account lockout config keys (defaults match IP policy) | | `LoginAttemptTrackerTest.java` | Tests for cross-IP account accumulation, disable flag, success reset | | `TestPasswordValidator.java` | Tests for blocked-account path | ## New config keys (defaults) | Property | Default | |----------|---------| | `ranger.usersync.unixauth.account.lockout.enabled` | `true` | | `ranger.usersync.unixauth.account.max.failed.attempts` | `5` | | `ranger.usersync.unixauth.account.attempt.window.ms` | `60000` | | `ranger.usersync.unixauth.account.lockout.duration.ms` | `30000` | ## Test plan - [x] `cd unixauthservice && mvn test` — 29/29 pass (`LoginAttemptTrackerTest`, `TestPasswordValidator`, `TestUnixAuthenticationService`) - [ ] CI on `master` ## Related - JIRA: https://issues.apache.org/jira/browse/RANGER-5690 - Original fix: PR #1080 - Same change on `ranger-2.9`: PR #1098 Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
