Daniel Convissor

For the email preferences, perhaps I’ll add an option for admins to choose if they want one notification or repeated notifications.

This has been added in the new release, 0.32.0.

There’s also new text in the readme about how this plugin blocks attackers.

Bozz: I’m still curious what you think about enhancements needed, if any, to the notification emails.

The FAQ has been updated with a section entitled “Will you provide lock outs / blocks in addition to slow downs?” based on the “perspective” post, above.

Hi:

If this happens again, please reopen the thread with the requested error messages.

–Dan

The length of time is mentioned at the top of the email. If an attacker gets in, a separate email is sent explaining that they were booted out and the password reset.

Are you suggesting the passage you quoted include some text saying something like “Don’t worry, even if they do get in, they’ll be immediately ejected.”

That’s now how it’s supposed to work. From your description, it sounds like you’re using an old version and/or have strange user/settings data. Please use the “Yes, delete the damn data” option on the settings page, deactivate the plugin, make sure you have the latest version installed (0.31.0) then activate it.

Please post back here and let me know how that goes.

Hi gwc_cd:

Another perspecitve on the “slow downs vs blocks” debate came to me the other day. It turns out Login Security Solution does indeed block. (Where “block” means “denies access” to attackers.) Below is a comparison of the attack handling logic used by Limit Login Attempts and Login Security Solution.

Limit Login Attempts

Invalid or Valid Credentials by Attacker or Actual User

1. Process authentication request (check IP address)
2. Error message: “Too many failed login attempts.” (ACCESS DENIED.)

Note, this approach means an actual user can be denied access for 12 hours after making 4 mistakes.

Login Security Solution

Invalid Credentials by Attacker or Actual User

1. Process authentication request (check IP, user name, and password)
2. Slow down the response
3. Error message: “Incorrect username or password.” (ACCESS DENIED.)

Valid Credentials by Attacker

1. Process authentication request (check IP, user name, and password)
2. Slow down the response
3. Set force password change flag for user
4. Error message: “Your password must be reset. Please submit this form to reset it.” (ACCESS DENIED.)

Valid Credentials by Actual User

1. Process authentication request (check IP, user name, and password)
2. (If user is coming from their verified IP address, let them in, END)
3. Slow down the response
4. Error message: “Your password must be reset. Please submit this form to reset it.” (ACCESS DENIED.)
5. On subsequent request… user verifies their identity via password reset process
6. User’s IP address is added to their verified IP list for future reference

So both plugins deny access to attackers. But Login Security Solution has the bonuses of letting legitimate users log in and slowing the attacks down. Plus LSS monitors user names, passwords, and IP’s for attacks, while all of the other plugins just watch the IP address.

I’m curious what your thoughts on this perspective are.

For the record, it’s not a permanent ban. The length of time is determined by the “Match Time” setting.

For the email preferences, perhaps I’ll add an option for admins to choose if they want one notification or repeated notifications.