New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong "auth failed" log message with two factor auth enabled #965

Open
Arno0x opened this Issue Feb 23, 2016 · 0 comments

Comments

1 participant
@Arno0x

Arno0x commented Feb 23, 2016

Hi,

If two factor authentication is enabled (and enforced), the user first has to enter his username and password, then press "Sign In" which triggers two things:

  1. The "Verification Code" input area is displayed in order for the user to enter his OTP
  2. An auth log message is created:
[2016-02-23 13:23:51] Auth failed: ip=x.x.x.x user=arno0x0x host=localhost port=143

Once the user has entered a correct OTP, he's properly logged into Rainloop.

This behaviour is obviously wrong since the authentication is not finished yet and you get a false positive "auth failed" message.

It is then impossible to create a proper fail2ban rules if a correct login triggers an "auth failed" message.

Cheers,
Arno

RainLoop added a commit that referenced this issue May 17, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment