Added exclusion to MaxInvalidLogin. #3192
Ylian Saint-Hilaire committed
Oct 13, 2021 at 17:15 UTC
8189ca025640e565fac4e96dd85f231fddae28d3
2 files changed
+14
-3
meshcentral-config-schema.json
+5
-3
@@ -228,10 +228,12 @@
228
"maxInvalidLogin": {
229
"type": "object",
230
"additionalProperties": false,
231
+ "description": "This section described a policy for how many times an IP address is allowed to attempt to login incorrectly. By default it's 10 times in 10 minutes, but this can be changed here.",
232
"properties": {
232
- "time": { "type": "integer" },
233
- "count": { "type": "integer" },
234
- "coolofftime": { "type": "integer" }
233
+ "exclude": { "type": "string", "default": null, "description": "Ranges of IP addresses that are not subject to invalid login limitations. For example: 192.168.1.0/24,172.16.0.1"},
234
+ "time": { "type": "integer", "default": 10, "description": "Time in minutes over which the a maximum number of invalid login attempts is allowed from an IP address." },
235
+ "count": { "type": "integer", "default": 10, "description": "Maximum number of invalid login attempts from an IP address in the time period." },
236
+ "coolofftime": { "type": "integer", "default": null, "description": "Additional time in minute that login attempts will be denied once the invalid login limit is reached." }
237
}
238
},
239
"amtProvisioningServer": {
webserver.js
+9
@@ -7665,6 +7665,15 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
7665
obj.setbadLogin = function (ip) { // Set an IP address that just did a bad login request
7666
if (parent.config.settings.maxinvalidlogin === false) return;
7667
if (typeof ip == 'object') { ip = ip.clientIp; }
7668
+ if (parent.config.settings.maxinvalidlogin != null) {
7669
+ if (typeof parent.config.settings.maxinvalidlogin.exclude == 'string') {
7670
+ const excludeSplit = parent.config.settings.maxinvalidlogin.exclude.split(',');
7671
+ for (var i in excludeSplit) { if (require('ipcheck').match(ip, excludeSplit[i])) return; }
7672
+ } else if (Array.isArray(parent.config.settings.maxinvalidlogin.exclude)) {
7673
+ for (var i in parent.config.settings.maxinvalidlogin.exclude) { if (require('ipcheck').match(ip, parent.config.settings.maxinvalidlogin.exclude[i])) return; }
7674
+ }
7675
+ return;
7676
+ }
7677
var splitip = ip.split('.');
7678
if (splitip.length == 4) { ip = (splitip[0] + '.' + splitip[1] + '.' + splitip[2] + '.*'); }
7679
if (++obj.badLoginTableLastClean > 100) { obj.cleanBadLoginTable(); }