Throttling Authentication Attempts doesn't work

[William Vincent (Wix31)]

Hello

I have a problem with throttling

When I do a lot of unsuccessful tries I get the message "Unauthorized access You have entered the wrong password too many times in a row. You have been rejected.".

But if I refresh the page, the form is displayed and in "cas/actuator/throttles" the line with my ip disappears

How do I make this persistent?

Maybe also would it be possible to send this ip to nftables?

Thanks in advance

My configuration :

CAS 6.6.6

build.graddle:

    //authentication/Configuring-Authentication-Throttling = secu DDOS

    implementation "org.apereo.cas:cas-server-support-throttle-bucket4j:${project.'cas.version'}"

    //authentication/Configuring-Authentication-Throttling = secu Brute Force

    implementation "org.apereo.cas:cas-server-support-throttle:${project.'cas.version'}"

cas.properties:

# Sécurité DDOS / Brute force

cas.authn.throttle.failure.range-seconds=30

cas.authn.throttle.failure.threshold=12

cas.authn.throttle.core.username-parameter=username

# Throttle DDOS

cas.authn.throttle.bucket4j.blocking=true

cas.authn.throttle.bucket4j.enabled=true

cas.authn.throttle.bucket4j.bandwidth[0].duration=PT60S

cas.authn.throttle.bucket4j.bandwidth[0].capacity=50

[Ray Bon]

William,

If the throttled user tries to log in after the page refresh, what happens?

Ray

On Wed, 2023-04-05 at 07:14 -0700, William Vincent (Wix31) wrote:

Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

[Pascal Rigaux]

Hi,

Throttling protects against brute force, so the time you refresh the page *manually* the throttling has been removed.

We have the exact same throttle conf. This conf allows 1 error per 2.5 seconds: you must wait 2.5 after a failure otherwise it will be rejected.
Our integration tests this: https://github.com/UnivParis1/integration-tests-cas-server/blob/main/throttle.test.js
(it checks french msgs, but you should get it)

On this subject, check https://apereo.github.io/cas/6.6.x/authentication/Configuring-Authentication-Throttling.html#failure-throttling

| Threshold Rate
|
| The failure threshold rate is calculated as: failureThreshold / failureRangeInSeconds. For instance, the failure rate for the above scenario would be 0.333333. An authentication
attempt may be considered throttled if the request submission rate (calculated as the difference between the current date and the last submission date) exceeds the failure
threshold rate.

cu

> --
> - Website: https://apereo.github.io/cas <https://apereo.github.io/cas>
> - Gitter Chatroom: https://gitter.im/apereo/cas <https://gitter.im/apereo/cas>
> - List Guidelines: https://goo.gl/1VRrw7 <https://goo.gl/1VRrw7>
> - Contributions: https://goo.gl/mh7qDG <https://goo.gl/mh7qDG>
> ---
> You received this message because you are subscribed to the Google Groups "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org <mailto:cas-user+u...@apereo.org>.
> To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/527ad47d-a0da-4763-8b9c-b84f89895e9an%40apereo.org
> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/527ad47d-a0da-4763-8b9c-b84f89895e9an%40apereo.org?utm_medium=email&utm_source=footer>.

[William Vincent]

ah ok thank's

i understand now, I confused, I thought it was like a fail2ban, but it's a rate limiting system!

but it's badly done, because if I set 

cas.authn.throttle.failure.range-seconds=3600

cas.authn.throttle.failure.threshold=5

it does not block for 1 hour if I have 5 bad logins

So I have to find another solution for ban , maybe by changing the log format to have it parsed by fail2ban

- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to a topic in the Google Groups "CAS Community" group.
To unsubscribe from this topic, visit https://groups.google.com/a/apereo.org/d/topic/cas-user/TCiEN94ph4k/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d1dc0899-ce8c-9754-3588-d3193587156d%40univ-paris1.fr.

--

-- William VINCENT Administrateur systèmes et réseaux

[William Vincent]

Hi

It works, user can login if using wrong password

William

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to a topic in the Google Groups "CAS Community" group.
To unsubscribe from this topic, visit https://groups.google.com/a/apereo.org/d/topic/cas-user/TCiEN94ph4k/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cas-user+u...@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/7dc94e757968e5d2e019a89b47740a670590716f.camel%40uvic.ca.

[Baba Ndiaye]

Hi Wiliam Vincent 
I'm trying to configure Throttling Authentication Attempts for a ban this 5 attempts failed login. But it's dont work for me
cas.authn.throttle.core.username-parameter=username
cas.authn.throttle.failure.threshold=5
cas.authn.throttle.failure.range-seconds=50

cas.authn.throttle.schedule.enabled=true
cas.authn.throttle.schedule.start-delay=PT10S
cas.authn.throttle.schedule.repeat-interval=PT60S

cas.authn.throttle.failure.throttle-window-seconds=PT5M

but when i have deux failed attempts it's banned. I need 5 attempts

[Ray Bon]

Baba,

The threshold and and range-seconds is a ratio; 5:50 == 1:10 (one attempt every 10s)

This is used to limit [mostly] automated login attempts. You should set this to a rate that a human would not normally exceed (i.e. how long does it take a human to enter a password and press enter / click a button).

https://apereo.github.io/cas/7.0.x/authentication/Configuring-Authentication-Throttling.html#failure-throttling

We track repeated failed attempts in our LDAP backend, so I do not know if cas has a mechanism for counting failed login attempts by a human.

Ray