Security: Rename admin and limit failed logins

[techsc]

Hello,

I have subsonic up and running on my web server, which is exposed to the internet. As it is a quite normal situation that web servers are target of attacks day by day it is crucial to have appropriate security policies.

On susbonic side, I have these basic requests:

1) How can I rename the 'admin' login?
2) Would you implement a policiy of max failed logins resulting in a account blocking for some minutes?

Thank you!

Chris

[Sporkman]

Hello,

I have subsonic up and running on my web server, which is exposed to the internet. As it is a quite normal situation that web servers are target of attacks day by day it is crucial to have appropriate security policies.

On susbonic side, I have these basic requests:

1) How can I rename the 'admin' login?
2) Would you implement a policiy of max failed logins resulting in a account blocking for some minutes?

Thank you!

Chris

Not a solution, but for 1 I gave admin a very long, random password & then never log in as admin (I set my own user as admin instead).

[techsc]

Hello,

I have subsonic up and running on my web server, which is exposed to the internet. As it is a quite normal situation that web servers are target of attacks day by day it is crucial to have appropriate security policies.

On susbonic side, I have these basic requests:

1) How can I rename the 'admin' login?
2) Would you implement a policiy of max failed logins resulting in a account blocking for some minutes?

Thank you!

Chris

Not a solution, but for 1 I gave admin a very long, random password & then never log in as admin (I set my own user as admin instead).

Yes, I did already choose a extra large password

[techsc]

Any input from the developer?

[serond]

I hoped to use fail2ban to do this but it seems the logging when someone get the "Wrong username or password." message are done in the database. There is one subsonic.log file but no logging are done to this or any other log file when the user logged in or the login failed.

[techsc]

I hoped to use fail2ban to do this but it seems the logging when someone get the "Wrong username or password." message are done in the database. There is one subsonic.log file but no logging are done to this or any other log file when the user logged in or the login failed.

Another nice approach, but stuck in missing log entries. But in the end, it is a workaround only

Security Policies - directly implemented - are the 1st choice here.

Chris

[techsc]

I hoped to use fail2ban to do this but it seems the logging when someone get the "Wrong username or password." message are done in the database. There is one subsonic.log file but no logging are done to this or any other log file when the user logged in or the login failed.

Another nice approach, but stuck in missing log entries. But in the end, it is a workaround only

Security Policies - directly implemented - are the 1st choice here.

Chris

@Sindre:
Is security policy on your roadmap?

Thanks
Chris

[serond]

I agree, Security Policies are the best choice. I created a Feature Requests for this.

To see the data in the database you can go to <subsonic>/db.view and enter SELECT * FROM INFORMATION_SCHEMA.SYSTEM_TABLES to display all the tables in the database. I did not discover any logging of user retries or last time a user accessed subsonic.

But a failed try does log to subsonic.log if anyone uses the api.

And according to this:
http://www.acegisecurity.org/faq.html
"A common user requirement is to disable / lock an account after a number of failed login attempts. Acegi itself does not provide anything "out of the box"

[techsc]

Generally speaking, security policies e.g. Account Lockout for a pre-defined period are pure basic features and very important to any server application.

Too bad, that the creator of Subsonic does not give any statement.

[evilnone]

Is there any input on this for the future? I am currently having my server being brute force attacked on the admin account and would love for any of these ideas in this thread to be implemented.

[techsc]

still no anser from the developer...

Is there any input on this for the future? I am currently having my server being brute force attacked on the admin account and would love for any of these ideas in this thread to be implemented.