lock user account after x login attempts

💬 General Discussion
1

Hello

does anyone know if this feature (lock user account after x login attempts) is enabled in SuiteCRM or if there is a conf file for fail2ban to ban the ip address which tried to login.

Regards

Cedric

2

Please see this SugarCRM forum topic.

3

Hello Will

Thanks for that. I found that too but I thought this is rather a clumsy approach given that possibly with every upgrade the code will be overwritten.

Isn’t there a more elegant version such as an addon or to build that into the code directly, given that SugarCRM is most likely not going to turn around on its decision on OpenSourcing SugarCRM 7.

Regards

Cedric

4

Hi,

I have created a fail2ban configuration for SuiteCRM. To implement you must add one line in the SuiteCRM code that logs an error:

file: modules/Users/authentication/SugarAuthenticate/SugarAuthenticate.php

Find the loginAuthenticate function as seen in the code snippet below and add the trigger_error line under the //FAIL2BAN CODE comment as seen in the code snippet below. (make sure its in the else statement)


	function loginAuthenticate($username, $password, $fallback=false, $PARAMS = array ()){
		global $mod_strings;
		unset($_SESSION['login_error']);
		$usr= new user();
		$usr_id=$usr->retrieve_user_id($username);
		$usr->retrieve($usr_id);
		$_SESSION['login_error']='';
		$_SESSION['waiting_error']='';
		$_SESSION['hasExpiredPassword']='0';
		if ($this->userAuthenticate->loadUserOnLogin($username, $password, $fallback, $PARAMS)) {
			require_once('modules/Users/password_utils.php');
			if(hasPasswordExpired($username)) {
				$_SESSION['hasExpiredPassword'] = '1';
			}
			// now that user is authenticated, reset loginfailed
			if ($usr->getPreference('loginfailed') != '' && $usr->getPreference('loginfailed') != 0) {
				$usr->setPreference('loginfailed','0');
				$usr->savePreferencesToDB();
			}
			return $this->postLoginAuthenticate();

		}
		else
		{ //begin else statement
			if(!empty($usr_id) && $res['lockoutexpiration'] > 0){
				if (($logout=$usr->getPreference('loginfailed'))=='')
	        		$usr->setPreference('loginfailed','1');
	    		else
	        		$usr->setPreference('loginfailed',$logout+1);
	    		$usr->savePreferencesToDB();
    		}

//FAIL2BAN CODE
trigger_error("LOGIN FAILED");
//FAIL2BAN CODE END

		} //end else statement
		if(strtolower(get_class($this)) != 'sugarauthenticate'){
			$sa = new SugarAuthenticate();
			$error = (!empty($_SESSION['login_error']))?$_SESSION['login_error']:'';
			if($sa->loginAuthenticate($username, $password, true, $PARAMS)){
				return true;
			}
			$_SESSION['login_error'] = $error;
		}


		$_SESSION['login_user_name'] = $username;
		$_SESSION['login_password'] = $password;
		if(empty($_SESSION['login_error'])){
			$_SESSION['login_error'] = translate('ERR_INVALID_PASSWORD', 'Users');
		}

		return false;

	}

/etc/fail2ban/jail.conf
(ensure logpath is pointed to the proper php log file, and ensure that E_USER_ERRORs are logged)


[apache-crm]
enabled = true
port    = http,https
action   = iptables[name=CRM, port=https, protocol=tcp]
           sendmail-whois[name=CRM, dest=banned@domain.ca, sender=fail2ban@domain.ca, sendername="Fail2Ban-CRM"]
filter  = apache-crm
logpath = /var/log/httpd/ssl_error_log
maxretry = 4

/etc/fail2ban/filter.d/apache-crm.conf


# Fail2Ban configuration file
[Definition]
failregex = [[]client <HOST>[]] PHP Notice:  LOGIN FAILED.*
ignoreregex =
1 Like
5

Could you give an explanation of what you want to do in this code?
Ty

6

@Espial you posted in a 8-year old thread :frowning:

Note that SuiteCRM now has adequate logging for fail2ban, there were several PR’s with this a few years ago. So you shouldn’t need to edit any code, you can just develop your fail2ban filters.

1 Like
7

Yes
I’m really digging a bit about this, just for the fact that I want to achieve something else:
I want to see a way to control the active sessions of an account
I have seen that in suite you can log in with the same account on different devices at the same time
Can this be configured so that it doesn’t happen?

8

I’ve seen that as a paid add-on, but I don’t think the option exists out-of-the-box, sorry.

1 Like
9

Could you give me the name of the plugin, or tell me where to get it?

10
1 Like