<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div class="moz-cite-prefix"><div dir="ltr" style="mso-line-height-rule:exactly;-webkit-text-size-adjust:100%;font-size:1px;direction:ltr;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;border-collapse:collapse;font-size:1px;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:20px 0 10px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:0 15px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="center" style="vertical-align:middle;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="center" style="padding:30px 0;vertical-align:middle;"><a href="http://www.cineca.it/" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image948881.png@DD320FA7.96A4BF62" width="100" height="22.22" border="0" alt="" style="width:100px;min-width:100px;max-width:100px;height:22.22px;min-height:22.22px;max-height:22.22px;font-size:0;" /></a></td></tr></table></td></tr><tr style="font-size:0;"><td align="center" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="center" style="padding:0 0 0 2px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="white-space:nowrap;color:#337AB7;font-size:14.67px;font-family:'Century Gothic';font-weight:400;font-style:normal;text-align:left;border-collapse:collapse;"><tr style="font-size:14px;"><td style="font-family:'Century Gothic';"><a href="http://www.cineca.it/" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#337AB7;">www.cineca.it</a></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:10px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:1px 11px 0 2px;vertical-align:top;"><a href="https://twitter.com/cineca1969" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image790440.png@00344683.BD48C8B9" width="17" height="17" border="0" alt="" style="width:17px;min-width:17px;max-width:17px;height:17px;min-height:17px;max-height:17px;font-size:0;" /></a></td></tr></table></td><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 11px 0 0;vertical-align:top;"><a href="https://www.facebook.com/Cineca1969/" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image534142.png@DEC4579A.DCE92FBD" width="18" height="18" border="0" alt="" style="width:18px;min-width:18px;max-width:18px;height:18px;min-height:18px;max-height:18px;font-size:0;" /></a></td></tr></table></td><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 11px 0 0;vertical-align:top;"><a href="https://it.linkedin.com/company/cineca" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image922180.png@A70DF961.3C6F0D52" width="18" height="18" border="0" alt="" style="width:18px;min-width:18px;max-width:18px;height:18px;min-height:18px;max-height:18px;font-size:0;" /></a></td></tr></table></td><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:1px 0 0;vertical-align:top;"><a href="https://www.instagram.com/CINECA1969/" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image551170.png@33ACEF7D.7F50B4DC" width="17" height="17" border="0" alt="" style="width:17px;min-width:17px;max-width:17px;height:17px;min-height:17px;max-height:17px;font-size:0;" /></a></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td><td align="left" style="padding:0;border-top:none;border-right:none;border-bottom:none;border-left:solid 2px #DADADA;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:0 0 0 15px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:5px 0 20px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;color:#337AB7;font-style:normal;font-weight:700;white-space:nowrap;"><tr style="font-size:17px;"><td align="left" style="padding:0;vertical-align:top;font-family:'Century Gothic';">Simone Lanzarini<span style="font-family:remialcxesans;font-size:1px;color:#FFFFFF;line-height:1px;"><span style="font-family:'template-dDYMf37tEe6JJQANOry0EQ';"></span><span style="font-family:'zone-1';"></span><span style="font-family:'zones-AQ';"></span></span></td></tr><tr style="font-size:0;"><td align="left" style="padding:0;vertical-align:top;"></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:0 0 20px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;border-collapse:collapse;font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:15px;font-weight:700;"><td align="left" style="vertical-align:top;font-family:'Century Gothic';">Direzione Tecnologie, Sistemi e Infrastruttura</td></tr><tr style="font-size:14px;"><td align="left" style="vertical-align:top;font-family:'Century Gothic';">Sede di Bologna</td></tr><tr style="font-size:14px;"><td align="left" style="vertical-align:top;font-family:'Century Gothic';">via Magnanelli 6/3, Casalecchio Di Reno</td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 10px 0 0;vertical-align:top;"><img src="cid:image045362.png@E22E36FA.E094F0CF" width="16" height="16" border="0" alt="" style="width:16px;min-width:16px;max-width:16px;height:16px;min-height:16px;max-height:16px;font-size:0;" /></td></tr></table></td><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14px;"><td align="left" style="padding:0 5px 0 0;vertical-align:top;font-family:'Century Gothic';">+39 0516171773</td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14px;"><td align="left" style="vertical-align:top;font-size:0;"><table cellpadding="0" cellspacing="0" border="0" style="border-collapse:collapse;font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 10px 0 0;vertical-align:top;"><img src="cid:image200907.png@DB395B56.CC673F30" width="16" height="16" border="0" alt="" style="width:16px;min-width:16px;max-width:16px;height:16px;min-height:16px;max-height:16px;font-size:0;" /></td></tr></table></td><td align="left" style="vertical-align:top;font-family:'Century Gothic';"><a href="mailto:s.lanzarini@cineca.it" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#337AB7;"><span style="text-decoration:underline;">s.lanzarini@cineca.it</span></a></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></div>Il 13/04/24 01:51, Matt Brennan via
users ha scritto:<br>
</div>
<blockquote type="cite" cite="mid:CACLBzuoFa1j+qKAVxQX_R78RgXGNPYXn_PUmyGgndfpNRQN6Qw@mail.gmail.com">
<div dir="ltr">I was wondering if anyone has any example rules how
they configure blocking brute force attempts against the IdP.
Certainly we have rules in place to lock out accounts which
protects against brute force, but this doesn't stop an attacker
who just wants to wreak havoc by intentionally locking out
multiple accounts.
<div><br>
</div>
<div>I've recently been trying to find a way to determine login
failures, but with everything I try to do I cannot tell the
difference between a failure versus a success and an MFA
prompt (since both result in a 302 to execution=e1s2). I don't
see any headers which indicate failure either. </div>
<div><br>
</div>
<div>Currently I'm just monitoring for too many 302s in a short
time, but I've had a few legit users get locked out when they
log in to multiple services in a short time (i.e. sitting down
and starting their day). </div>
<div><br>
</div>
<div>Can anyone else share how they are accomplishing this? Is
there a way to add a response header to indicate when a
failure occurs?</div>
<div><br>
</div>
<div>TIA!</div>
<div>-Matt</div>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
<p>Hi Matt,</p>
<p>there's a built-in IDP feature that I found very effective in
blocking brute force attempts and that avoids DDOS attacks and
that doens't require you to setup a dedicated WAF, or to implement
policies at LDAP level:<br>
</p>
<p><a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587/PasswordAuthnConfiguration#Advanced-Features">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587/PasswordAuthnConfiguration#Advanced-Features</a></p>
<p><br>
</p>
<p>The idea is to block a specific user login attempt coming from a
specific IP address. In this way, unless attacker ad victim are
behind the same network, you can lock only evil attempts leaving
legitimate accesses available. <br>
</p>
<p>This is an example bean definition:<br>
</p>
<p><br>
</p>
<pre class="code highlight" lang="xml"><span><span class=""> </span><span class="hljs-tag"><span class="hljs-tag"><</span><span class="hljs-name">bean</span><span class="hljs-tag"> </span><span class="hljs-attr">id</span><span class="hljs-tag">=</span><span class="hljs-string">"shibboleth.authn.Password.AccountLockoutManager"</span><span class="hljs-tag"></span></span></span>
<span><span class="hljs-tag"> </span><span class="hljs-attr">parent</span><span class="hljs-tag">=</span><span class="hljs-string">"shibboleth.StorageBackedAccountLockoutManager"</span><span class="hljs-tag"></span></span>
<span><span class="hljs-tag"> </span><span class="hljs-attr">p:maxAttempts</span><span class="hljs-tag">=</span><span class="hljs-string">"5"</span><span class="hljs-tag"></span></span>
<span><span class="hljs-tag"> </span><span class="hljs-attr">p:counterInterval</span><span class="hljs-tag">=</span><span class="hljs-string">"PT50S"</span><span class="hljs-tag"></span></span>
<span><span class="hljs-tag"> </span><span class="hljs-attr">p:lockoutDuration</span><span class="hljs-tag">=</span><span class="hljs-string">"PT20S"</span><span class="hljs-tag"></span></span>
<span><span class="hljs-tag"> </span><span class="hljs-attr">p:extendLockoutDuration</span><span class="hljs-tag">=</span><span class="hljs-string">"false"</span><span class="hljs-tag"> /></span><span class=""></span></span>
</pre>
<p>Simone</p>
<p></p>
</body>
</html>