Any creative solution to make it harder for hackers to copy your IdP login page?

[Martin Lunze]

Hi Peter,

we are collecting such tipps in the "wiki of the DFN-AAI" [1].

At the moment it's only available in german and the part for "blocking 
brute-force attacks" [2] is not really well-formed.
Time was missing to write some more lines ;-)

I will explain it here, it's not much to do.

First i edited the logging of idp like this:

Change the "pattern" for the appender "IDP_PROCESS" in the "logback.xml" 
like this:

> <Pattern>%date{ISO8601} - %mdc{idp.remote_addr:-n/a} - %level 
> [%logger:%line] - %msg%n%ex{short}</Pattern>

Then install "fail2ban" and configure it like this:

> # vi /etc/fail2ban/filter.d/shibboleth.conf
>
> [Definition]
>
> failregex = \- <HOST> \- .* \- Authentication failed for
>           \- <HOST> \- .* \- search for user=.* failed
>
> ignoreregex =

> # vi /etc/fail2ban/action.d/shibboleth.conf
>
> [Definition]
>
> actionstart =
> actionstop =
> actioncheck =
> actionban = printf %%b "<ip> -\n" >> <deny-config>
> actionunban = sed -i "/^<ip> -$/d" <deny-config>
>
> [Init]
>
> deny-config = /etc/apache2/conf.d/shib.deny

> # vi /etc/fail2ban/jail.d/shibboleth.conf
>
> [shibboleth]
> enabled  = true
> filter   = shibboleth
> action   = shibboleth
> logpath  = /opt/shibboleth-idp/logs/idp-process.log
> findtime = 300


Normally fail2ban blocks users (ip-addresses) per iptables.
Often not the best, because normal users did not get any information 
what happens. Only a white screen occurs in the browser.

I have chosen the option to redirect blocked users to a static webpage 
via the apache config.
More informations about the "hosts-deny" rewrite rule can be found here [3].

My apache config looks like this:

> RewriteEngine on
> RewriteMap hosts-deny "txt:/etc/apache2/conf.d/shib.deny"
> RewriteCond "${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND}" "!=NOT-FOUND"
> RewriteRule ^(.*)$ %{DOCUMENT_ROOT}/Blockiert/index.html [L]

On the static html-page the users will get some info like this:

> Login failed to often.
> You are blocked for 10 minutes.
> Please try again later.

Thats all.

In my opinion a nice solution to automatically block AND unblock 
ip-addresses without reloading or restarting any service.
A nice side effect is, that you will receive less tickets of users why 
they didn't reach the login-form if you use fail2ban with default actions.

Notice: If some departments are using proxies or NAT you have to exclude 
this addresses with a separate line:

> # vi /etc/fail2ban/jail.d/shibboleth.conf
>
> ignoreip = 141.56.16.37 141.56.16.72

I hope this helps to understand.

With nice regards
Martin

[1] https://wiki.aai.dfn.de/de:dfnaai:start
[2] https://wiki.aai.dfn.de/de:shibidp3fail2ban
[2] https://httpd.apache.org/docs/2.4/rewrite/access.html#host-deny

Am 28.03.2018 um 13:46 schrieb Peter Schober:
> * Martin Lunze <martin.lunze at tu-dresden.de> [2018-03-28 07:02]:
>> Nevertheless i use fail2ban to temporary block attacking ip
>> addresses.
> Wanna share your config to do this with the Shib IDP somewhere,
> e.g. on the wiki?
> -peter
>

-- 
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5677 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20180404/4d19f06b/attachment.p7s>