Download the PHP package egcservices/rbruteforce2 without Composer

On this page you can find all versions of the php package egcservices/rbruteforce2. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package rbruteforce2

rBruteForce

CakePHP 4+ Plugin for Protection Against BruteForce Attacks

CakePHP rBruteForce Plugin

With rBruteForce you could protect your CakePHP applications from Brute Force attacks.

Requirements

Installation

1. Create the database tables.

The schema could be found in config/Schema/rBruteForce.sql.

The migrations files could be found in config/Migrations.

Install via composer.

Add the plugin to your project's composer.json - something like this:

`

Load the plugin

.gitignore

Because this plugin has the type cakephp-plugin set in it's own composer.json, composer knows to install it inside your /Plugin directory, rather than in the usual vendors file. It is recommended that you add /Plugin/RBruteForce to your .gitignore file.

Reporting Issues

If you have a problem with rBruteForce please report here

Documentation

rBruteForce bans IP-s on unsuccessful login, or on any other method.

Usage

As this plugin is a component you should add it to your Controller's $components array.

Let's see an example for the UsersController login method with rBruteForce

That is all! :)

Options

You could use options to alter the default behaviour.

You do not have to include options where default value is good for you. For example.

maxAttempts

Users will banned after this many unsuccessful attempts. Normally 3-5 should be enough.

expire

The ban will exists for this time. This should be something like:

dataLog

If this option is set to true the user submitted data will be saved to the plugin's database. You could analize this data any time you want.

attemptLog

There are two valid values; all and beforeBan

If you choose all than all attempts will be logged into the plugins database. If you choose beforeBan only attempts before banning will be logged.

checkUrl

Shoud the plugin include the url into the brute force check or not.

If set to false and somebody try to login at /users/login and than at /admin/users/login the plugin will count as they would be the same url. If set to true the plugin will se thw two above as different attempts.

cleanupAttempts

When you suffer a brute force attack you could have thousands of log entries in the database in a few minutes. If you want to limit how much data should be stored you could use this option. Normally you should not worry about this till you have less than a million record.

How does it work?

When a user (or an automated attack) send some data to login (or any other) function CakePHP will call your controller's corresponding method. In this method you should have

This method calls the plugin and it will log every attempts. It checks the plugin database for the clients IP address. If there are more entries there within the given expiration the plugin bans the request, logs the attempt and redirect the user to the failed login page. Automated attacks will see this as a successful login.

On every failed attempt the plugin delays the rendering of the page with an extra 1 second. So after 3 attempts the rendering will be delayed with 3 seconds. This slows down automated attacks, and just a little inconvinience for real users.

If an IP address is banned and you check before user authentication the plugin will not let the user get in even with valid username and password.

To remove the ban before expire you should browse to /r_brute_force/rbruteforces and delete the ban manually. Alternatively you just wait till the ban expires.

Submitted data entries available at /r_brute_force/rbruteforcelogs.

Warning

This is not a firewall! If you use this plugin you are still open to brute force attacks. Slow attacks involving proxies are really hard to detect. If you want protection agains them you should write your own protection methods, like limiting user accounts after a few attempts, or asking for extra login data like security question, or whitelist IP-s from where admins could log in, or other ideas. In the same time you could ban top attempt sources on your server firewall. This information is available at /r_brute_force/rbruteforces. Be careful to not to ban out proxies used by legitim users.


All versions of rbruteforce2 with dependencies

PHP Build Version
Package Version
Requires php Version >=7.2
cakephp/cakephp Version >=4.0.1
cakephp/migrations Version ^3.2
cakephp/plugin-installer Version ^1.3
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package egcservices/rbruteforce2 contains the following files

Loading the files please wait ....