Feature Request: include IP and username in logging for failed attempts

[davekaufman]

Feature Request

Improve logging of failed login attempts

Issue

Currently, failed login attempts are logged like so:

{"log":"ERROR: Username or password is incorrect. Try again.\n","stream":"stdout","time":"2018-08-08T19:33:20.892869034Z"}

Ideally, these log messages would include the IP address of the host attempting login, and username that was attempted. Including this information would allow for better monitoring and alerting, as well as blocking of bad actors.

Suggestion

Include IP address and username in log message.
Example:

{"log":"ERROR: Username or password is incorrect. Try again.\n","IP":"192.0.2.23","username":"[email protected]","stream":"stdout","time":"2018-08-08T19:33:20.892869034Z"}

[mprasil]

Excellent idea and shouldn't be too hard to implement.

[Baelyk]

I'm interested in trying to add this, but I can't seem to find any log file. The only logging that I am finding is the logging to stdout that Rocket usually does.

Am I missing something obvious?

[mprasil]

There's #63 for logging to file, but that is currently pending some upstream changes. So this is purely about changing that single failure message to include requested information.

[dani-garcia]

The stdout now logs IP and user on failed login attempts.
For those behind proxy, you might need to configure the proxy to create a X-Real-IP header with the external IP of the request.

[philw07]

This is a useful feature, however I noticed the IP is only logged when trying to log in with a valid username and a wrong password (with the message "Username or password is incorrect"). When trying to log in with a username for which no account exists however only "Invalid user" is logged.
What's even worse is that the same error messages are displayed in the web vault UI, so a potential attacker can immediately see if an account exists or not.
I think the error message should be "Username or password is incorrect" including logged IP in any case.

[dani-garcia]

That should be fixed now in b75ba21. Thanks for reporting it!