Send email on failed login

[rezyek]

I'm trying to implement some security into my Aflresco 4 community edition installation by having the system send an email each time an attempt is made to login but fails.

So whenever this popup is shown:

FAILED TO LOGIN
The remote server may be unavailable or your authentication details have not been recognized.
OK

I would like to receive an email.

Is this possible? Can somebody steer me in the right direction?

[openpj]

You could override the AuthenticationService component of Alfresco catching the AuthenticationException and nesting the code to send the email.

Hope this helps.

[rezyek]

Thanks for your reply.

Your pointer suggest altering code right? I'm not a developer at all so that's a bit of a challenge!

What about the database itself … are failed login attempts logged? I could create a trigger on the database in that case …

Possible?

[rezyek]

Just a quick bump … this feature would be really handy for me.

Anyone any ideas?

[jmuras]

Hi Rezyek,

I presume you could also write a script that would monitor alfresco.log and look for login exception:

2012-04-18 13:35:18,653  ERROR [extensions.webscripts.AbstractRuntime] [http-bio-8080-exec-9] Exception from executeScript - redirecting to status template error: 03180003 Login failed
org.springframework.extensions.webscripts.WebScriptException: 03180003 Login failed

When it happens then send e-mail. I do not think that you can avoid programming to do that.

[rezyek]

Thanks for your replies .. I've come up with this solution:

(Running Alfresco Community Edition 4.0d on CentOS 6)

Install an apache webserver in front of alfresco tomcat. I've found that this also gives you some more flexibility … and you can keep your alfresco completely vanilla if needed. Playing around with apache settings is a lot easier than tomcat!

Just forward your apache virtualhost with AJP to tomcat. Add this this to your virtualhost config:

ProxyPass / ajp://localhost:8009/
ProxyPassReverse / ajp://localhost:8009/‍‍

Now I've used OSSEC (http://www.ossec.net) to monitor my server, and I've also set it up so it monitors failed logins on my alfresco site.

OSSEC works pretty ok out of the box. Just add this to the web_rules.xml file:

  <rule id="31163" level="5">
      <if_sid>31100</if_sid>
      <match>/share/page/type/login?error=true</match>
      <options>alert_by_email</options>
      <description>Alfresco failed login</description>
      <group>invalid_login,</group>
  </rule>

  <rule id="31164" level="10" frequency="2" timeframe="120" ignore="60">
      <if_matched_sid>31163</if_matched_sid>
      <description>Multiple failed login attempts on Alfresco portal.</description>
      <group>invalid_login,</group>
  </rule>‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The first rule will monitor you apache log for "/share/page/type/login?error=true" and it will send an email when it occurs. The second rule will block the originating IP-address if multiple failed logins are seen. By default it will block for 600 seconds but you can alter this in OSSEC.

Make sure you add your apache log file to ossec.conf like this:

  <localfile>
    <log_format>apache</log_format>
    <location>/var/log/httpd/access_log</location>
  </localfile>
‍‍‍‍‍

There still some work to do like moving the OSSEC rules to a separate file (the standard files are overwritten during update), but it's quite functional as it is right now.

Let me know if you like my solution and if you need any help implementing it.

[aweber1nj]

@rezyek:
I like your solution, but I am concerned with the scalability of monitoring the access.log file.  I realize that most of the monitoring tools use inotify or something similar now, but still…that file is constantly in use!  I was considering disabling access logging entirely, but maybe that's not really a great idea for security-audit/review purposes either.

Good idea, though.

-AJ