Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
彭彦祖
code-server
提交
c48a275d
C
code-server
项目概览
彭彦祖
/
code-server
与 Fork 源项目一致
从无法访问的项目Fork
通知
1
Star
1
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
C
code-server
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
未验证
提交
c48a275d
编写于
7月 09, 2019
作者:
D
Dean Sheather
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
add timestamp to auth log, add fail2ban conf+docs
上级
14d91717
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
60 addition
and
1 deletion
+60
-1
doc/security/code-server.fail2ban.conf
doc/security/code-server.fail2ban.conf
+15
-0
doc/security/fail2ban.md
doc/security/fail2ban.md
+42
-0
packages/server/src/server.ts
packages/server/src/server.ts
+3
-1
未找到文件。
doc/security/code-server.fail2ban.conf
0 → 100644
浏览文件 @
c48a275d
# Fail2Ban filter for code-server
#
#
[
Definition
]
failregex
= ^
INFO
\
s
+
Failed
login
attempt
\
s
+{\
"password\"
:\
"(\\.|[^"
])*\
",\"
remote_address
\
":\"
<
HOST
>\
"
ignoreregex
=
datepattern
=
"timestamp"
:{
EPOCH
}}$
# Author: Dean Sheather
doc/security/fail2ban.md
0 → 100644
浏览文件 @
c48a275d
# Protecting code-server from bruteforce attempts
code-server outputs all failed login attempts, along with the IP address,
provided password, user agent and timestamp by default. When using a reverse
proxy such as Nginx or Apache, the remote address may appear to be
`127.0.0.1`
or a similar address unless the
`--trust-proxy`
argument is provided to
code-server.
When used with the
`--trust-proxy`
argument, code-server will use the last IP in
`X-Forwarded-For`
(if provided) instead of the remote socket address. Ensure
that you are setting this value in your reverse proxy:
Nginx:
```
location / {
...
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
...
}
```
Apache:
```
<VirtualEnv>
...
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
...
</VirtualEnv>
```
It is extremely important that if you enable
`--trust-proxy`
you ensure your
code-server instance is not accessible from the internet (block it in your
firewall).
## Fail2Ban
Fail2Ban allows for automatically banning and logging repeated failed
authentication attempts for many applications through regex filters. A working
filter for code-server can be found in
`./code-server.fail2ban.conf`
. Once this
is installed and configured correctly, repeated failed login attempts should
automatically be banned from connecting to your server.
packages/server/src/server.ts
浏览文件 @
c48a275d
...
...
@@ -89,13 +89,15 @@ export const createApp = async (options: CreateAppOptions): Promise<{
if
(
cookies
.
password
)
{
if
(
!
safeCompare
(
cookies
.
password
,
options
.
password
))
{
let
userAgent
=
req
.
headers
[
"
user-agent
"
];
let
timestamp
=
Math
.
floor
(
new
Date
().
getTime
()
/
1000
);
if
(
Array
.
isArray
(
userAgent
))
{
userAgent
=
userAgent
.
join
(
"
,
"
);
}
logger
.
info
(
"
Failed login attempt
"
,
field
(
"
password
"
,
cookies
.
password
),
field
(
"
remote_address
"
,
remoteAddress
(
req
)),
field
(
"
user_agent
"
,
userAgent
));
field
(
"
user_agent
"
,
userAgent
),
field
(
"
timestamp
"
,
timestamp
));
return
false
;
}
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录