I am in the process of modifying an already built login system to suit my needs. I have seen that there is a special MySQL database table that is being used to record how many attempts a user has made to login. If the user has lets say attempted 5 times with no success, that user will be put on hold for a specific period of time.

My question is, how necessary is it? If we want to prevent a script from making automatic login attempts, is this not handled at web server or firewall level?

share|improve this question
    
That won't hurt to make a script that'll prevent users from attempting to log in too many times in PHP. It can be coupled with a firewall as well. – D4V1D May 31 '15 at 6:15
    
This question is off-topic for SO. I can tell by your other questions you have asked, that your questions are getting closed and down voted because of this. I suggest you read this: stackoverflow.com/help/how-to-ask – Wade Shuler May 31 '15 at 6:24
up vote 0 down vote accepted

This question is off topic. To answer it, I would use the comment box, but this is too long..

cphulk is a service on cpanel servers that you might have. It does not monitor the logins to your personal scripts (ie: Wordpress). It monitors your logins to the services running on your server, like cpanel login, whm login, ssh, email (ie: smtp), and other processes.

It is absolutely necessary to thwart brute-force attempts at the script level for any moderate site. If it's your own personal little login page, no big deal. If you have thousands of members, then yeah you will want to. If your handling money, or anything that causes a concern for security, yes. If you have forms that let the user's upload to the server, yes. In most cases, yes you do and should.

Simply tracking the username/email and how many attempts isn't enough. Bots use proxies and rotate usernames/emails. They may use a list of 10k usernames and try 10 passwords only.. ie: 10 failed attempts per account, to fly under the radar, and thousands of proxies.

The best way is to protect both ways, by too many attempts by IP address (no matter the username tried), and too many attempts per account.

If an IP has tried to login to > 10 accounts in the past 60 minutes, block them for x minutes/hours.

If an IP has had > 10 failed logins in the past 15 minutes (no matter the account), block it for 15 minutes.

If an account has had more than 10 failed logins in the past 15 minutes, lock it for 15 minutes.

Keep another table for your IP block records. If they have been blocked more than say 3 times in the past 24 hours, block the IP for 24 hours.

You could move up, and repeat blockers, alert you to check it out so you can blacklist the IP.

Just some ideas, adjust the method/actions/times as you see fit.

share|improve this answer
    
Nice. I did work on it and implemented 3 things to prevent brute force: (1) Blocked when a number of attempts made for a single account. (2) Blocked when a number of attempts made from a certain IP address. (3) Restricted the number of requests sent to application per second. – head_scratcher Aug 6 '15 at 13:44

I think shared servers are managed to handle brute force attacks. But it does not mean you should be careless about it, nor it is worth. You have to stop requests of a suspicious user, to avoid consuming server's resources.

Now, you can handle this through Sessions ($_SESSION) as the first level of security, then record the attempts in database for further checkup. For instance you can trace when a user has many failed attempts who then might be treated as a possible security threat, since he/she is different from a normal user who might have one-time five login failures.

After all, not only it is necessary, but it also is very crucial for a healthy system, to have several layers of login-security, you may also have:

client-side (disable input on submission, CAPTCHA etc.) sever-side ($_SESSION, Database, Server Firewarll etc.)

share|improve this answer
    
Shared servers don't handle brute force attacks on your own scripts, ie: your wordpress login form, or any other script you have with a login form. – Wade Shuler May 31 '15 at 6:21
    
Yes they do not interfere into your scripts, generally they stop a client who is sending too many request in an unusual manner. After all, not all of them handle, some of then are configured by poor admins. – Mostafa Talebi May 31 '15 at 6:25
    
You said most shared servers. Hostgator and GoDaddy would be top of that list. They do the bare min to keep the number of support requests down. The don't care about your site. If you run some $10 script written by someone who picked up PHP yesterday, and get hacked, that's on you. You would implement something like CloudFlare to do what your referring to. I don't know of any main stream shared host that cares how many attempts a user makes on your site. – Wade Shuler May 31 '15 at 6:35
    
I believe hosting companies do implement some mechanism to stop attacks like Denial of Service or Slowloris. Because if they do not do it, hackers can use up resources of their servers and put their services at risk. I have read that there are modules for Apache web server just for these purposes. For example mod_qos and mod_evasive etc. – head_scratcher May 31 '15 at 8:35
    
Executing a DoS attack on a GoDaddy or Hostgator site can easily be done with only 1, 1gbps VPS and a decent DoS script (C, perl, etc). This question has nothing to do with a DoS flood, it has to do with bots trying to brute force a valid login to their personal php sites. If you want DoS protection, checkout CloudFlare's paid packages, or some other service that is specifically designed for it. – Wade Shuler Jun 1 '15 at 22:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.