Strange behavior: lots of logins by one user

[Manolo Garcia Alvarez]

Thanks Jim,

an anti-DDoS policy is a great idea, but we'd prefer to identify first the
source of the problem. I'm still on it.

If we don't manage to get the answer, I suppose we'll end up with a
anti-DDoS policy in our viprion.

Thanks again !

------------------------------
Manolo García
Arquitectura i Sistemes
Universitat Oberta de Catalunya

93 326 (3451) | 689 88 30 93 | mgarciaal at uoc.edu
Parc Mediterrani de la Tecnologia (edifici B3)
Av. Carl Friedrich Gauss, 5.
08860 Castelldefels
[image: Universitat Oberta de Catalunya]
Aquest missatge s'adreça exclusivament a qui va destinat i pot contenir
informació privilegiada o confidencial i dades de caràcter personal, la
difusió de les quals és regulada per la Llei orgànica de protecció de dades
i la Llei de serveis de la societat de la informació. Si no sou la persona
destinatària indicada (o la responsable de lliurar-lo a qui va destinat),
no heu de copiar aquest missatge ni lliurar-lo a tercers per cap concepte.
Si heu rebut aquest missatge per error o l'heu aconseguit per altres
mitjans, us demanem que ens ho comuniqueu immediatament per aquesta mateixa
via i l'elimineu irreversiblement.

Abans d'imprimir aquest missatge electrònic penseu en el medi ambient.


El jue., 31 ene. 2019 a las 19:07, Jim Fox (<fox at washington.edu>) escribió:

>
> > We are reducing the suspects to Google Suite (which is the SP that's
> causing the logins), an specific browser or a combination of both. About
> your
> > "Force Authentication" suggestion, we are running 3,1 and this is a
> production environment and will affect a lot of users, so I don't think it's
> > possible.  We're now trying to identify the browser of the users with
> huge number of logins, but as you said it's clear the problem it's on the
> > SP.
>
> We have had this issue for many years and never did figure out what the
> cause is.  I suspect phone apps, for no really good reason.
>
> We mitigate the problem by temporarily denying access to clients that hit
> the IdP at too rapid a rate.  First we used mod_evasive, now we use
> scripts on our F5 traffic manager.  Essentually any client that makes,
> say, 20 requests in 10 seconds gets blocked for a minute. (Not the exact
> numbers.)  Sometimes this stops the offender.  Sometime they come back in
> a minute.
>
> Jim--
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190201/3b1c5ac5/attachment.html>