Skip to content

🪲: Security>AutomaticBanning: The purpose of intervals isn't properly documented. #96

@rcfa

Description

@rcfa

What happened?

Automatic banning
Auth failures (Optional) 8 366 days

What does this mean:
A: if in an ARBITRARILY long period, 8 auth failures accumulate, the IP will be blocked for a duration of 366 days
OR
B: If in a (sliding) interval of 366 days, 8 auth failures accumulate, the IP will be blocked INDEFINITELY.

From the hover legends "The maxium number of failed login attempts before the IP is banned" it doesn't follow which of the two possible semantic interpretations is applicable. The fact that under Blocked IPs there's no "days remaining" counter in the list, would suggest B, but that's just a wild guess.

How can we reproduce the problem?

I can reproduce the problem by doing the following steps:

Version

v0.15.x

What database are you using?

None

What blob storage are you using?

None

Where is your directory located?

None

What operating system are you using?

None

Relevant log output

Code of Conduct

  • I agree to follow this project's Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions