I am using this fine module on various D6 websites and its awesome.
But I tried to use it for D7 and stumbled on various problems.

The most important one is actually the way it works when banning hosts.
So, first it soft bans user, then it blocks user and those two works (first one works a bit random though).

But when I pass amount of attempts for soft or hard block hosts, nothing happens. I dont see any kind of block, I can still use site and try to login (with valid username). I dont see new entry in module's mysql table nor I see any entry in ip blocked hosts.

I tried to configure by README and by two issues here, but none help. Simply put, I cant make this module block host. Am I missing something, are there any configurations I dont know, how to set up etc...? Is it abandoned, is there a known problem...? I m very puzzled why terrible D7 version works comparing to D6 which still works awesome.

I thought it might doesnt like Login Toboggan, so I disabled LT. Still no success. Other modules are classic like views, apachesolr, ubercart....

Any input regarding this issue is very welcome.

Comments

elegantsolutions’s picture

elegantsolutions commented

I agree, I have had this and more serious issues with the 7.x version of this module. I held off some of my D6 - D7 migrations because I found the 6.x version so effective. So when 7.x was updated I eagerly moved forward on my migrations.

Unfortunately, even though the last security update 7.x-1.4 fixed the security hole, I continued to get Session opened for "." from unknown sources in my log. I have been using Rules to setup an access notification email when someone logged in so I knew right away. The only thing that saved me was using Content with ACL restricted to specific users on all important data. I then gave up and removed the module and had no issues since.

Its too bad because in principle this is a terrific module, but I believe it still has severe security issues that I do not have the time or expertise to fix.

deekayen’s picture

deekayen commented

I think there's a mystery problem because this module and flood control are competing. In retrospect, it would have probably been better to have switched to use the core flood control system for managing blocked hosts than to continue with a custom one. That's probably ultimately the solution to these issues.

milovan’s picture

milovan commented

Flood control module is much lighter than Login security in terms of features.

Is there a hint or some research by community whats the problem in D7 version? Maybe we can debug and manage to fix it. This module is too good to be wasted. I d be happy to chase down mystery problem on my free time, and any kind of hint or some previous look into a problem might speed up things.

If not, it ll take time.

firewaller’s picture

firewaller commented
Issue summary: View changes

My site is currently getting multiple failed login attempts per second (brute force?), but it seems like the module only bans hosts if the attempts are made against existing usernames in the site (not random emails - see _login_security_add_event()). It would be nice to have an option to protect the site against hostnames regardless of whether or not the attempt is against an existing user.