[keycloak-user] info about brute force detection
The question of Mara was perfectly legitimated and the answers are not
really acceptable.
I have the opinion that the number of failures needs to be persisted and the
designer should not make assumption about the times and periods for server
restarts
Secondly, where should be such a brute detection implemented if not in
Keycloak?
In effect is is implemented, but the implementation can be made better.
FYI information we implemented it using the functionalities of the LDAP
server.
Regards,
Giovanni
>In addition, is pretty much possible to configure fail2ban to read
the
>log files and store it into the database for example
>(http://www.fail2ban.org/wiki/index.php/Commands#DATABASE).
>
>I can be wrong, but I don't think Keycloak should have something like this.
>
On Fri, Dec 4, 2015 at 5:26 PM, Stan Silvert <ssilvert at redhat.com
<https://lists.jboss.org/mailman/listinfo/keycloak-user> > wrote:
On 12/4/2015 12:15 PM, Notarnicola, Mara wrote:
Dear all,
I have enabled brute force detection on my keycloak application server.
I used keycloak 1.5.0 Final version.
After several trials I saw that the number of failures of the users are
saved in session, so if the server will be restarted the counter starts from
0 again.
Why you don¹t save it into db?
I didn't design this, but I think it's because brute force detection is
designed to thwart guessing of credentials over a relatively short time
period. In production you don't restart the server very often.
Mara
_______
Attachments:
- smime.p7s (application/pkcs7-signature — 5.0 KB)
- attachment.html (text/html — 2.3 KB)