RocketChat / RocketChat/Rocket.Chat

[bug] 'Block failed login attempts by Username' not prevent to LDAP account to be locked

Open
#18,939 10 comments 0 reactions 1 assignee View on GitHub

@pierre-lehnen-rc is already working on this.

Since Oct 2, 2020.

area: authentication security type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

https://github.com/RocketChat/Rocket.Chat/pull/17783 was introduced ability to block failed login attempts by Username and IP. It should mitigate LDAP accounts from locked-out, but in fact, it's not do that.
I think, now it's only stops local accounts password brute-force, which is great actually.
@MarcosSpessatto @rodrigok @sampaiodiego @pierre-lehnen-rc please take a look at that issue.

Steps to reproduce:
  1. Enable all options in Failed login Attempts section of Admin UI
  2. Try to login with LDAP account and wrong password 10 times (for example. You need more, then set in settings)
  3. Message warning shows that you temporarily blocked, but you still can do attempts to lockout LDAP account
Expected behavior:

When account is temporarily locked in Rocket Chat, there should not be authentication attempts to LDAP for LDAP users

Actual behavior:

In login page I see warning
image
But in fact all login attempts continue to ask LDAP server to authenticate user. Which lockout user, because password is wrong and Active Directory policy is set to temporarily (30 min) lock-out accounts after 5 failed login attempts.
I see this in logs (Logs section)
Here is my lockout settings
image
image

Server Setup Information:
  • Version of Rocket.Chat Server: 3.6.0
  • Operating System: CentOS7
  • Deployment Method: docker
  • Number of Running Instances: 3
  • DB Replicaset Oplog: Enabled
  • NodeJS Version: 12.16.1
  • MongoDB Version: 4.0.17
Client Setup Information
  • Desktop App or Browser Version: 2.17.7 and Chrome 84.0.4147.89
  • Operating System: Windows 10
Additional context

If account is locked in Rocket Chat side, all login attempts (LDAP) for that account should be stopped.

And about Rocket Chat blocking failed attempts I have 2 questions:

  1. Can Admin manually unlock blocked account?
  2. Can I see in logs, that account is locked temporarily?
Relevant logs:
LDAP ➔ Auth.info Not authenticated CN=Karlan Anton (Test1),OU=test,OU=Users,DC=company,DC=com
LDAPHandler ➔ info Wrong password for KarlanAAt01
LDAPHandler ➔ info Fallback to default account system { username: 'KarlanAAt01' }
Failed login detected - Username[unknown] ClientAddress[YYY.YYY.YYY.YYY] ForwardedFor[XXX.XXX.XXX.XXX, YYY.YYY.YYY.YYY] XRealIp[YYY.YYY.YYY.YYY] UserAgent[Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36]
LDAP ➔ Search.info Idle
LDAP ➔ Connection.info Disconecting

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.