Admin Tools

#12531 WAF did not block IPs of repeated offenders

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by nicholas on Friday, 01 June 2012 02:32 CDT

Friday, 01 June 2012 00:48 CDT

user47161

Joomla! version: 1.5.26
PHP version: 5.2.17
MySQL version: 5.1.62-cll
Host: huberbilder.com
Admin Tools version: 2.2.2

Description of my issue: last night I had a failed login attack on my backend with more than 500 failed logins but your component did not block the IP though I had enabled automatic IP blocking of repeated offenders in WAF (see screenshot).

Why did your admin tools not stop these attacks after 3 failed login attempts?

Regards,
Michael

Friday, 01 June 2012 02:14 CDT

nicholas

Michael,

First please upgrade to version 2.2.6. Your version is not supported.

Then please check that all login attempts come from the same IP address. According to your setup an IP will be blocked if it causes a security exception three times within 60 minutes.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Friday, 01 June 2012 02:24 CDT

user47161

I already upgraded, but that should not cause the issue. Version 2.2.2 is supposed to work, too.

And yes, all 500+ attacks (within 1 hour!) came from the very same IP (184.154.212.210) but your WAF did not block it until my provider disabled the whole directory after 500 sent alert eMails within 1 hour (!), because he considered it an e-mail abuse issue.

Friday, 01 June 2012 02:32 CDT