9

A brute-force attack is an attempt to gain unauthorized access to a website by continually generating and inputting various combinations of a password. This task is usually done by automation software (a "bot") which looks for success or failure messages and keeps trying new passwords until it gets a success message.

Is Drupal 7 safe against it by default? what is more secure configuration for it ? Which module can help me for more secure sign in?

Improve this question
2
  • 1
    The answer depends on what kind of attack you're talking about. Do you mean a brute force attack where the attacker guesses that the user "admin" has a password of "Password1" and then guesses maybe that the password is "javagod" ?
    – greggles
    Sep 14, 2012 at 6:24
  • yes,as title of question brute force login attack :(
    – Yuseferi
    Sep 14, 2012 at 6:36

4 Answers 4

Reset to default
12

As you can see in the code, the function user_login_final_validate register a flood event. That means if a same IP try to connect a user/login password many times we will be "banned" for a while.

This is one of the protections that Drupal offers. Another one, and I think if its happens to your web site you will notice it very fast, it's the CSRF token that Drupal generate for each form.

This means that the attacker bot should generate the form, then get the token and associate it with the submit form. That is very time consuming and will likely discourage the attacker. But first, you will see your server starting get hotter.

Improve this answer
4
  • for simulation login form your just need copy/paste drupal login form.you can test it, if you copy/paste html of another drupal site in your local test file (just sure action of form is absolutly redirect to domain.com/user/login ) , run it localy fill it with valid user and pass you see logged in !!!!!
    – Yuseferi
    Sep 5, 2012 at 17:08
  • This form will work as long as Drupal as the token (and the form) cached on his database. Once the cached expired your form will not work.
    – yvan
    Sep 5, 2012 at 18:28
  • I cleared cache but work still
    – Yuseferi
    Sep 5, 2012 at 18:29
  • 1
    The CSRF protection can be disabled and is disabled on the login form. It's also disabled on the search form. But, as yvan stated, the flood protection prevents brute force attacks on the form itself. This wouldn't prevent a distributed attack from someone who had access to a botnet, but log analysis (something like Droptor) that looks for repeated failed logins for the same user would fix that.
    – greggles
    Sep 28, 2012 at 13:57
3

In addition to the good measures that Drupal 7 implements for stopping login attempts, I would suggest installing Spambot module, that deals specifically with new user registration attempts.

At every new user registration, that module will query Stop Forum Spam server to see if the user attempting registration is a known bot.

You can optionally contribute to Stop Forum Spam with your website's registration attempts.

Improve this answer
3

There is Flood control

This project is intended to add an administration interface for hidden flood control variables in Drupal 7, like the login attempt limiters and any future hidden variables.

The functions to define and interact with core flood control system

The flooding system provides us three functions:

flood_register_event($name, $window = 3600, $identifier = NULL)

Register an event for the current visitor to the flood control mechanism.

flood_clear_event($name, $identifier = NULL)

Make the flood control mechanism forget about an event for the current visitor.

flood_is_allowed($name, $threshold, $window = 3600, $identifier = NULL)

Checks whether user is allowed to proceed with the specified event. Basically, we check if a user has access by calling flood_is_allowed. If it returns FALSE, throw an ‘Access Denied”. Whenever a user performs the action we call flood_register_event.

By default it checks the user's ip adress. But we could pass some other unique identifier like the user id.

Above copied from Playing with Drupal’s flooding system

Improve this answer
2
  • 1
    Please don't copy and paste from the web without proper attribution
    – Clive ♦
    Jan 21, 2013 at 14:56
  • 1
    @Clive i will take care of that from now on. And thats what i want to convey though.
    – niksmac
    Jan 21, 2013 at 15:00
0

Thinking (and having) this problem, I wrote a module which allow you to prevent this kind of attacks: https://drupal.org/project/AntispammerBot

You can select which roles are safe, how many nodes the user can publish before considering it an spam attack, etc...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.