RocketChat / RocketChat/Rocket.Chat
[bug] 'Block failed login attempts by Username' not prevent to LDAP account to be locked
@pierre-lehnen-rc is already working on this.
Since Oct 2, 2020.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
https://github.com/RocketChat/Rocket.Chat/pull/17783 was introduced ability to block failed login attempts by Username and IP. It should mitigate LDAP accounts from locked-out, but in fact, it's not do that.
I think, now it's only stops local accounts password brute-force, which is great actually.
@MarcosSpessatto @rodrigok @sampaiodiego @pierre-lehnen-rc please take a look at that issue.
Steps to reproduce:
- Enable all options in Failed login Attempts section of Admin UI
- Try to login with LDAP account and wrong password 10 times (for example. You need more, then set in settings)
- Message warning shows that you temporarily blocked, but you still can do attempts to lockout LDAP account
Expected behavior:
When account is temporarily locked in Rocket Chat, there should not be authentication attempts to LDAP for LDAP users
Actual behavior:
In login page I see warning

But in fact all login attempts continue to ask LDAP server to authenticate user. Which lockout user, because password is wrong and Active Directory policy is set to temporarily (30 min) lock-out accounts after 5 failed login attempts.
I see this in logs (Logs section)
Here is my lockout settings


Server Setup Information:
- Version of Rocket.Chat Server: 3.6.0
- Operating System: CentOS7
- Deployment Method: docker
- Number of Running Instances: 3
- DB Replicaset Oplog: Enabled
- NodeJS Version: 12.16.1
- MongoDB Version: 4.0.17
Client Setup Information
- Desktop App or Browser Version: 2.17.7 and Chrome 84.0.4147.89
- Operating System: Windows 10
Additional context
If account is locked in Rocket Chat side, all login attempts (LDAP) for that account should be stopped.
And about Rocket Chat blocking failed attempts I have 2 questions:
- Can Admin manually unlock blocked account?
- Can I see in logs, that account is locked temporarily?
Relevant logs:
LDAP ➔ Auth.info Not authenticated CN=Karlan Anton (Test1),OU=test,OU=Users,DC=company,DC=com
LDAPHandler ➔ info Wrong password for KarlanAAt01
LDAPHandler ➔ info Fallback to default account system { username: 'KarlanAAt01' }
Failed login detected - Username[unknown] ClientAddress[YYY.YYY.YYY.YYY] ForwardedFor[XXX.XXX.XXX.XXX, YYY.YYY.YYY.YYY] XRealIp[YYY.YYY.YYY.YYY] UserAgent[Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36]
LDAP ➔ Search.info Idle
LDAP ➔ Connection.info Disconecting
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.