Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Select view

Select search mode

 
16 of 16

Admin Console Login allows Brute Force Login

Fixed

Description

Openfire Admin Console allows brute force login.
It MUST implement some security verifications and listeners that monitors login attempts.

  • Limit login attempts per IP in a time period.

  • Limit login attempts in a time period.

  • Test Cases ( Optional )

Environment

Every Plataform

Details

Assignee

Reporter

Original estimate

Time tracking

No time logged1d remaining

Components

Fix versions

Affects versions

Priority

Created March 26, 2007 at 10:20 PM
Updated August 26, 2008 at 3:50 AM
Resolved August 26, 2008 at 3:50 AM

Activity

Show:

LGApril 22, 2007 at 12:51 AM

Adding a random delay of 1-3 seconds is never a fault if the password is wrong before returning an error.
An option to limit the remote addresses (e.g. 10.0.0.0/24 or *.dialin.provider.com) would help a lot.

Thiago Rocha CamargoApril 21, 2007 at 12:00 AM

An day has 86400 seconds. A week 604800. I don't think that it's sufficient. In 3 months it's very easy to get in. I don't think admins change admin password every month. Or at least we MUST not trust in it.
This is a Best Pratices issue.

Johannes GrimmApril 20, 2007 at 9:31 PM

perhaps a simple delaying the error msg would sufficant ... so bruteforce takes really long .. (0.5 or 1 sec should be enough)

Flag notifications