Brute Force Protection Non-Functional

csheaupdesigns · February 20, 2023, 9:45pm

We recently noticed some brute force attacks on our Grafana site. When looking into options for brute force protection, I came across the Grafana configuration parameter, disable_brute_force_protection, which is set to False by default. I have not changed it in my configuration. However, I ran a test to enter the wrong password for an existing username and I was able to enter the wrong password 20-30 times before giving up. What is the status of this feature? Does it actually work?

zakkirkharim · July 5, 2023, 5:38am

Should this question be asked in someother forum to get a reply?

melori.arellano · July 17, 2023, 7:31pm

@csheaupdesigns I tested this and initially thought it wasn’t working because I expected to see something in the UI telling me that I exceeded my login attempts.

When I tried to log in after 20+ bad passwords, I could not log in with the correct password. So I decided to search the code, which works after 5 failed attempts - BUT - the UI didn’t tell me how many tries I had left or when the account was locked.

github.com

grafana/grafana/blob/10510d5138a8033dcbf3f5bb3a639a6e153f5a9e/pkg/services/loginattempt/loginattemptimpl/login_attempt.go#L14


      
          	"context"
          	"time"
          
          	"github.com/grafana/grafana/pkg/infra/db"
          	"github.com/grafana/grafana/pkg/infra/log"
          	"github.com/grafana/grafana/pkg/infra/serverlock"
          	"github.com/grafana/grafana/pkg/setting"
          )
          
          const (
          	maxInvalidLoginAttempts int64 = 5
          	loginAttemptsWindow           = time.Minute * 5
          )
          
          func ProvideService(db db.DB, cfg *setting.Cfg, lock *serverlock.ServerLockService) *Service {
          	return &Service{
          		&xormStore{db: db, now: time.Now},
          		cfg,
          		lock,
          		log.New("login_attempt"),
          	}

I’d suggest opening an issue in github for this to find out if the current UI behavior was intentional or open a discussion about changing it.

I opened a docs PR to find out if we want to document the expected behavior.