Download the PHP package ashanet/rbruteforce without Composer
On this page you can find all versions of the php package ashanet/rbruteforce. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package rbruteforce
rBruteForce
CakePHP 3 Plugin for Protection Against BruteForce Attacks
CakePHP rBruteForce Plugin
With rBruteForce you could protect your CakePHP applications from Brute Force attacks.
Requirements
- CakePHP 3.0.0 or greater.
- PHP 5.4.16 or greater.
Installation
1. Create the database tables.
The schema could be found in config/Schema/rBruteForce.sql.
The migrations files could be found in config/Migrations.
Install via composer.
`
Add the plugin to your project's composer.json - something like this:
`
Load the plugin
.gitignore
Because this plugin has the type cakephp-plugin set in it's own composer.json, composer knows to install it inside your /Plugin directory, rather than in the usual vendors file. It is recommended that you add /Plugin/RBruteForce to your .gitignore file.
Reporting Issues
If you have a problem with rBruteForce please report here
Documentation
rBruteForce bans IP-s on unsuccessful login, or on any other method.
Usage
As this plugin is a component you should add it to your Controller's $components array.
Let's see an example for the UsersController login method with rBruteForce
That is all! :)
Options
You could use options to alter the default behaviour.
You do not have to include options where default value is good for you. For example.
maxAttempts
Users will banned after this many unsuccessful attempts. Normally 3-5 should be enough.
expire
The ban will exists for this time. This should be something like:
- 20 seconds
- 5 minutes
- 1 hour
- 2 days
- 3 weeks
- 1 month
dataLog
If this option is set to true the user submitted data will be saved to the plugin's database.
You could analize this data any time you want.
attemptLog
There are two valid values; all and beforeBan
If you choose all than all attempts will be logged into the plugins database.
If you choose beforeBan only attempts before banning will be logged.
checkUrl
Shoud the plugin include the url into the brute force check or not.
If set to false and somebody try to login at /users/login and than at /admin/users/login
the plugin will count as they would be the same url.
If set to true the plugin will se thw two above as different attempts.
cleanupAttempts
When you suffer a brute force attack you could have thousands of log entries in the database in a few minutes. If you want to limit how much data should be stored you could use this option. Normally you should not worry about this till you have less than a million record.
How does it work?
When a user (or an automated attack) send some data to login (or any other) function CakePHP will call your controller's corresponding method. In this method you should have
This method calls the plugin and it will log every attempts. It checks the plugin database for the clients IP address. If there are more entries there within the given expiration the plugin bans the request, logs the attempt and redirect the user to the failed login page. Automated attacks will see this as a successful login.
On every failed attempt the plugin delays the rendering of the page with an extra 1 second. So after 3 attempts the rendering will be delayed with 3 seconds. This slows down automated attacks, and just a little inconvinience for real users.
If an IP address is banned and you check before user authentication the plugin will not let the user
get in even with valid username and password.
To remove the ban before expire you should browse to /r_brute_force/rbruteforces and delete the ban manually.
Alternatively you just wait till the ban expires.
Submitted data entries available at /r_brute_force/rbruteforcelogs.
Warning
This is not a firewall! If you use this plugin you are still open to brute force attacks. Slow attacks
involving proxies are really hard to detect. If you want protection agains them you should write your own
protection methods, like limiting user accounts after a few attempts, or asking for extra login data
like security question, or whitelist IP-s from where admins could log in, or other ideas.
In the same time you could ban top attempt sources on your server firewall. This information is available
at /r_brute_force/rbruteforces. Be careful to not to ban out proxies used by legitim users.
