Background:
I have the latest version of Phabricator running on a Debian server with LDAP as authentication provider.
Problem:
I'd like to secure my server from brute force password guessing attempts through Phabricator, by using fail2ban and Phabricator's access log output.
However, Phabricator's access log has two major issues:
- There is no clear indication in the access log that a web-fronted log-in attempt failed. Phabricator does not send a clear HTTP status code such as 401 as a response for a failed log-in attempt. Right now it's always 200 OK.
- The date output format of %D and %e cannot be interpreted by fail2ban. Fail2ban would require a source code patch in order to support Phabricator's date format.
Related problem:
it is not possible to change log.access.format using bin/config. It gives the following error message:
Usage Exception: Config key "log.access.format" is of type "wild". Specify it in JSON.
I had to edit that value manually in the local JSON configuration file.
Suggested solutions:
- Add an authentication error response to the access log output. That could be done as HTTP status code 401 or maybe some additional log output for that purpose.
- Give an option for customizing the log output date format.
- ...or change the date format to something fail2ban understands.