2

In my drupal site, often i see this message for the admin account

Sorry, too many failed login attempts from your IP address. This IP address is temporarily blocked.

I know i can solve it clearing the 'flood' database table, and i'm almost sure it is caused by people or bot trying to login as admin. 'Almost' for in the table flood the failed attemps have identifier '1-127.0.0.1' that is the local ip and it sound strange to me... There is a way to avoid the problem for good? (and to be sure it is about people/bot trying to login and not something else?)

(I mean obviously a convenient way. Allowing all the login attemps without blocking them is not a solution.)

  • So...you want to disable the feature that blocks people trying to gain unauthorised access to the admin user account? Isn't that a dangerous idea? – Clive Nov 16 '15 at 14:23
  • No, i edited the question and specified i do not want it. I was wondering if there is a way to stop the problem in a clever way i cannot imagine, and to guess what is happening. If the attemps came from a precise ip, i could control them, but a request coming from localhost... it is normal? it is really someone trying to hack my site? how to distinguish 'bad' attemps from 'good' attemps? – Sasha Grievus Nov 16 '15 at 14:33
  • 1
    That's not something Drupal can help you with, it doesn't know what your network considers to be good/bad traffic. You'll need to make that decision based on your own policies. Only you (or someone who knows your setup) would be able to tell you if a request from the loopback address is normal; it might be, might not be, totally depends. Ask your server administrator whether that should be happening – Clive Nov 16 '15 at 14:56
  • I am the server administrator :D – Sasha Grievus Nov 16 '15 at 15:04
  • I tried to google it as a server problem instead of a drupal one, and seems to be a pretty common issue karelbemelmans.be/2015/04/… Changing point of view could lead me to the solution. Hooray for Clive ;) – Sasha Grievus Nov 16 '15 at 15:10
5

The answer can be found in this article

https://www.karelbemelmans.be/2015/04/reverse-proxy-configuration-for-drupal-7-sites/

Adding these lines to settings.php solves the issue:

$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = array('127.0.0.1');
$conf['reverse_proxy_header'] = 'HTTP_X_FORWARDED_FOR';

Added these lines, in the flood table of the drupal site database, every failed login request is logged with the real ip the request came from.

The real problem, indeed, was not lying in the failed login attemps, but in linking all the attemps to the loopback address. Looking at the flood table in drupal database, I could see every request under the ip 127.0.0.1, which is wrong and causes any request from any user (and any ip) to be blocked if anyone from any ip tried to login with wrong passwords. Linking attemps to their right ip makes the drupal flood protection working as expected, that is blocking attemps only from the ip which tried to login with wrong password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.