Cockpit CMS UserFlood Addon

This addon extends Cockpit CMS (Next) core by providing a very simple feature of locking users after a configurable number of failed login attempts.

Installation

Manual

Download latest release and extract to COCKPIT_PATH/addons/UserFlood directory

Git

git clone https://github.com/pauloamgomes/CockpitCMS-UserFlood.git ./addons/UserFlood

Cockpit CLI

php ./cp install/addon --name UserFlood --url https://github.com/pauloamgomes/CockpitCMS-UserFlood.git

Composer

Make sure path to cockpit addons is defined in your projects’ composer.json file:

{
   "name": "MY_PROJECT",
   "extra": {
       "installer-paths": {
           "cockpit/addons/{$name}": ["type:cockpit-module"]
       }
   }
}

In your project root run:

composer require pauloamgomes/cockpitcms-userflood

Configuration

The number of failed attempts can be configured as below:

flood:
  errors:  4    # max. allowed retries before lockout
  lockout: 20   # minutes lockout
  block:   4    # deactivate user after 4 consecutive lockouts
  failban: true # auto-blacklist malicious users based on ip behavior

If no configuration is provided a default of 4 login failures is used.
An user is set to inactive (blocked) after 16 consecutive failed login attempts (tot. 4 lockouts).
The failban option automatically blacklist user’s IP related to max number of allowed errors.

Usage

The UserFlood Addon doesn’t provide (yet) any user interface, it works on the background during the authentication workflow, using the cockpit.authentication.failed, cockpit.authentication.success and cockpit.accounts.save events.

A user is set to inactive (blocked) when it fails n login attempts.
In order to be able to login user needs to be set again to Active via admin interface.

Extensibility

The UserFlood Addon provides the following events that can be handled by other Addons:

flood.insert - on each failure attempt
flood.block - when max number of failed attemps is reached and user is locked
flood.reset - when flood user entries are removed

Todo and Improvements

Block user via ip address
Define a timeline where the blocking should occur (e.g. block if 10 attemps in last hour)
Create admin interface with list of all flood events