[wp-hackers] Limit Login Attempts

[onlyunusedname]

I've been using something similar to what Jesse describes: limiting
attempts based on username so that I may disregard IP.  Does that overlook
something important?


On Tue, Apr 16, 2013 at 11:30 AM, Tom Barrett <tcbarrett at gmail.com> wrote:

> Is there any way to set up a collective pool, a global 'limit login
> attempts blacklist'?
>
>
> On 16 April 2013 16:25, Chip Bennett <chip at chipbennett.net> wrote:
>
> > I agree that Limit Login Attempts is useful, and does block single-IP
> > brute-force attacks. (I use, and love, Limit Login Attempts.)
> >
> > But this particular botnet has demonstrated the ability to vary the IP
> > address used to brute-force a given site. That behavior, IIRC, has been
> > observed in the wild.
> >
> > My caution in adding Limit Login Attempts to core in response to this
> > attack is that it would give a false sense of security, WRT both
> > brute-force login attempts and DDoS.
> >
> >
> > On Tue, Apr 16, 2013 at 11:14 AM, Chris Williams <chris at clwill.com>
> wrote:
> >
> > > Because if you only allow each IP four (Five? Six?) login attempts per
> > > day, you essentially stop them all.
> > >
> > > In my log analysis, it's not the case that each IP only makes a few
> > > attempts.  They try hundreds/thousands. Now they are hitting my block,
> > > which requires a block of four attempts four times (16 total hits in a
> > one
> > > day period).
> > >
> > > If you look at the analysis on this, it all says something like "at
> 1000
> > > attempts/minute it takes only N days to crack your short password".
> >  Well,
> > > at 4 attempts/day, that number becomes millennia.
> > >
> > > More to the point, why NOT do this?  It doesn't require everyone to
> > change
> > > their password.  It doesn¹t require everyone to remove the "admin"
> > > account. It doesn't require any changes at all, yet helps protect even
> > the
> > > most lax of password choosers.
> > >
> > > On 4/16/13 7:53 AM, "Chip Bennett" <chip at chipbennett.net> wrote:
> > >
> > > >If 90,000 unique IP addresses are attempting a brute-force attack, in
> > > >which
> > > >no single IP address makes more than a handful of attempts, how
> > effective
> > > >will it be to limit login attempts by IP address?
> > > >
> > > >I would support the inclusion of Limit Login Attempts in core, based
> on
> > > >its
> > > >utility; however, it won't do any particular good in dealing with the
> > full
> > > >potential of the current attack.
> > > >
> > > >
> > > >On Tue, Apr 16, 2013 at 10:36 AM, Chris Williams <chris at clwill.com>
> > > wrote:
> > > >
> > > >> I made a rather reasonable proposal, and received plenty of advice,
> > but
> > > >> the proposal never was vetted.  Now the issue of brute force attacks
> > has
> > > >> even received Matt's attention:
> > > >> http://ma.tt/2013/04/passwords-and-brute-force/
> > > >>
> > > >> On the dozen or so WP sites I manage, wp-login.php is frequently
> among
> > > >>the
> > > >> top 10 most often accessed pages.  Yes, I have removed the admin
> > > >>account.
> > > >>  Yes, I have robust passwords.  Yes, I have plugins to help.  Yes, I
> > am
> > > >> playing whack-a-mole and blocking the IPs one-by-one.  But brute
> force
> > > >> attempts to login are happening at an alarming rate.
> > > >>
> > > >> Wordpress should include login attempt limiting as part of core:
> > > >>
> > > >>  *   Logging into WP is a core feature
> > > >>  *   Usernames and passwords are a core part of WP security
> > > >>  *   Password strength metering is a core feature
> > > >>  *   Limiting guesses is a key way to defend against brute force
> > attacks
> > > >>
> > > >> Is this the end-all-be-all to WP security?  No, of course not.
> > > >>
> > > >> But much of WP security depends on not being able to get access to
> > > >> privileged accounts.  And limiting login attempts is a simple,
> > > >> straightforward, non-invasive way to dramatically improve that
> > security.
> > > >>  It has almost no impact on the good guys and virtually eliminates a
> > > >>common
> > > >> exploit path.
> > > >>
> > > >> Not every WP site allows comments, so having Akismet a plugin makes
> > > >>sense.
> > > >>  Many other other plugins make sense as plugins.  But logging into
> WP
> > > >>is an
> > > >> essential facility.
> > > >>
> > > >> Limiting login attempts should be part of core.
> > > >>
> > > >> Chris
> > > >> _______________________________________________
> > > >> wp-hackers mailing list
> > > >> wp-hackers at lists.automattic.com
> > > >> http://lists.automattic.com/mailman/listinfo/wp-hackers
> > > >>
> > > >_______________________________________________
> > > >wp-hackers mailing list
> > > >wp-hackers at lists.automattic.com
> > > >http://lists.automattic.com/mailman/listinfo/wp-hackers
> > >
> > > _______________________________________________
> > > wp-hackers mailing list
> > > wp-hackers at lists.automattic.com
> > > http://lists.automattic.com/mailman/listinfo/wp-hackers
> > >
> > _______________________________________________
> > wp-hackers mailing list
> > wp-hackers at lists.automattic.com
> > http://lists.automattic.com/mailman/listinfo/wp-hackers
> >
>
>
>
> --
> http://www.tcbarrett.com | http://gplus.to/tcbarrett |
> http://twitter.com/tcbarrett
> _______________________________________________
> wp-hackers mailing list
> wp-hackers at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-hackers
>