My IP gets banned, without login attempts

[nitobuendia]

Home Assistant release with the issue:
Version: 0.97.2

Operating environment (Hass.io/Docker/Windows/etc.):
Hass.io
System: HassOS 2.12
Deployment: production
Installed on Raspberry Pi 3

Component/platform:
HTTP (ip_ban.yaml) / Auth

Description of problem:
Every few days, I get my own IP banned. This usually happens while navigating on my Macbook or Android phone (web version).

If I am using DuckDNS URL, the IP that gets banned is always my external IP. This blocks me from using the DuckDNS URL. Then, I need to use the local Raspberry IP, use configurator to remove the IP Ban entry and get it fixed.

However, this also happens if I am using the local network IP for the Raspberry Pi to use the UI. In this case, my internal IP would be banned instead. I do not have an iPhone. I only use web on my Mac and Android phone. The Android phone is usually open in the Lovelace home view.

This is hard to reproduce, but it is happening at least once a week.

Problem-relevant configuration.yaml entries and (fill out even if it seems unimportant):

ip_ban_enabled: true
login_attempts_threshold: 3

and my Auth provider is homeassistant:

auth_providers:
  - type: homeassistant

I have DuckDNS Add-On installed. However, as stated, it would ban internal or external IP depending on whether I am using DuckDNS URL or Raspberry Pi IP directly.

Additional information:

I do not want to disable either protection system, I just want to understand why my own IP gets banned without any manual intervention. Note that I’ve also checked the time at which I got banned, and there were no other devices connected to my internet. So it’s not like someone accessed my local network and sent requests on my behalf.

Any ideas on what could be triggering this?

[matteofranceschini]

I have the same issue with the iPhone app that connects via vpn to the raspberry with the app.

It looks like that if I use the app from ouside via vpn and then connect to the my home wireless nerwork if the VPN disables itself for some reason then I get a login failed.

I'm still trying to understand the exact situation that triggers this, but it happens daily.

[DeviousPenguin]

I think this may be due to unclean session disconnect / reconnect, maybe over websockets?

I get the same thing happen, I have a valid session cookie in my browser, yet when connecting to HA I get 'bad authentication attempt' in my log for the IP address that has already logged in.

This happens in both a normal http session using HA in browser, and also using HTTPS websockets using NGINX reverseproxy and tileboard.

A (bad) workaround is to use LLAT, I use LLAT with nodeRED websockets as currently that is the only way to do things.

[nitobuendia]

I have not been able to consistently reproduce, so I cannot confirm @DeviousPenguin hypothesis. However, I do can confirm that I usually keep my HomeAssistant tab open on both Mac and Android all the time.

Also, wanted to add that more people are reporting similar errors on the community, so it seems a bit widespread.

[DeviousPenguin]

I forgot to mention before that I'm currently moving from a HassIO based setup to a VENV based setup, however both setups have this issue.

The only thing I haven't tried yet it the Command Line auth provider as detailed here:

https://www.home-assistant.io/docs/authentication/providers/

I'm still moving things over between 2 Rpi's right now, but once I get everything working smoothly with my VENV based setup I may see if using the Command Line auth provider is a good workaround this issue.

Has anyone else tried it?

[nitobuendia]

@DeviousPenguin A "workaround" (or more like an alternative suggestion) in the Community is to toss away IP ban and add 2FA as a security replacement. Probably limiting to a range/set of IPs might be a good idea too, if possible. Not really a workaround, but a way to avoid the issue without compromising security.

[lbouriez]

Same issue, I had to disable ip_ban_enabled to access HA again. It started today...

[stale]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue now has been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

[DeviousPenguin]

@DeviousPenguin A "workaround" (or more like an alternative suggestion) in the Community is to toss away IP ban and add 2FA as a security replacement. Probably limiting to a range/set of IPs might be a good idea too, if possible. Not really a workaround, but a way to avoid the issue without compromising security.

Thanks, I may well give that a try. I'm not the only user however so I need to check that 2FA is OK for the other users, but so far with my IP ban set to 20 attempts per day I don't get bans very often but it is annoying as it's always machines that are already logged in getting banned.

Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.

Updated to 0.103, issue not resolved

[nitobuendia]

After a long quiet time, this started happening to me again recently on version 0.103.5. The spike is "coincidentally" aligned with a change of domain (from DuckDNS to my own domain). It could also be correlated with having installed the PWA app.

[firasnajjar]

This is happening to me as well. Every couple of days, my iPhone's IP gets blocked. This happens only when I'm using the iPhone app. On the android app I do not see such thing.

[DrCryptoToad]

This just happened to me (v0.100.3). I was confused to see my internal IP address banned. I did not enter the password incorrectly, as it is usually always left logged in. When I couldn't login I reset the Pi and found that it was because my IP had been banned. I will try updating this week, though.

[nitobuendia]

I still experience it from time to time. I have not been able to consistently reproduce it, but usually it happens if I restart or re-login from one device, and then I use a different one. Does this resonate with others?

Something like:

• Restart system form my PC.
• Immediately after restart is done, use an actions (e.g. script) from my Android (web UI) without refreshing the page first.

[firasnajjar]

I think I can reproduce this. Sometimes, when I open the iOS app, it says that it is reconnecting. If you try to do anything when it is still reconnecting, e.g. turn on a light or anything else, afterwords, I get blocked and 403 error.

My assumption is that any action done while the app is reconnecting, will send a request to homeassistant possibly with an expired token which results in the ip of the phone being banned.

I hope this can help!