Re: [I] [Hardening] F-15: Failure to Block Abusers by IPs. [cloudstack]
github-actions[bot] commented on issue #13343: URL: https://github.com/apache/cloudstack/issues/13343#issuecomment-5346144560 ## 🎯 Triage report Requests IP-based tracking/blocking of failed API authentication attempts to mitigate brute-force/lockout abuse. Maintainers noted that login attempts are already logged in the API log and management log, and discussion has centered on whether a dedicated, lower-volume auth log (to make fail2ban-style tooling practical) is warranted versus a workaround (grepping the existing management-server log). ### 📊 Assessment | Dimension | Value | Reasoning | |---|---|---| | **Type** | type:enhancement | Feature request for a new/refined logging and rate-limiting capability. | | **Component** | component:api, component:management-server | Concerns the management API's authentication path and its logging. | | **Severity** | n/a | Hardening/feature request, not a bug. | | **Labels** | type:enhancement, component:api, component:management-server | See above | | **Coding agent** | Needs more info | The exact scope (new dedicated auth.log file vs. rate-limiting/IP blocking logic vs. just documentation of a fail2ban filter) has not been settled by maintainers yet. | 💡 Notes and suggestions A pragmatic incremental step discussed in comments: document a fail2ban filter that greps `command=login` entries from the existing management-server log, before committing to a new dedicated log file or in-app rate limiting. > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/32259459580) · sonnet50 262K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) > Add this agentic workflows to your repo To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9 ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [I] [Hardening] F-15: Failure to Block Abusers by IPs. [cloudstack]
DaanHoogland commented on issue #13343: URL: https://github.com/apache/cloudstack/issues/13343#issuecomment-5068429862 > It would be very helpful if authentication attempts were written to a separate log file, such as `/var/log/cloudstack/management/auth.log`. This would make sense, but my point is, would the api.log file also work? loging attempts should be there as well. And as a workaround somekind og `grep -w “.*START.*command=login.* /var/log/cloudstack/management/management-server.log >> /var/log/cloudstack/management/auth.log 2>/dev/null” #notprogrammingadvice, could also work. Not to refuse your issue, but to explore workaround(s). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [I] [Hardening] F-15: Failure to Block Abusers by IPs. [cloudstack]
daviftorres commented on issue #13343: URL: https://github.com/apache/cloudstack/issues/13343#issuecomment-5047811874 Hey @DaanHoogland, thanks for commenting on this thread. I'm very familiar with Fail2Ban, but I don't use it with ACS because, with debug logging enabled (which is almost always required for troubleshooting), our four Management Server instances generate around 8~10 million log lines per day. It would be very helpful if authentication attempts were written to a separate log file, such as `/var/log/cloudstack/management/auth.log`. That would make Fail2Ban much more practical to use and would also reduce the amount of data that XDR/SIEM tools need to process. With the current log volume, it's simply not practical. Does that make sense? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [I] [Hardening] F-15: Failure to Block Abusers by IPs. [cloudstack]
DaanHoogland commented on issue #13343: URL: https://github.com/apache/cloudstack/issues/13343#issuecomment-5046532927 @davift , login attempts are logged in both apilog and management-log. @wido , don’t you have a fail2ban howto for cloudstack (sorry if I mis-remembered) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
