mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-30 04:33:00 +02:00
Joachim Wiberg
beabc1fe5b
Adds an nginx-side rate limit on POST /login so a brute-force or DoS attempt can't pin the box on the bcrypt-shaped credential check inside rousette/PAM. Configuration: - Keyed on $binary_remote_addr (per source IP), 5 requests/minute sustained with a burst of 3 nodelay, a real user fumbling their password three times in a row sails through; the 4th attempt in the same window returns 429. - GET /login is unmetered (the keyed map yields the empty string, which limit_req treats as "no key, no limit"), so a 401-driven HX-Redirect bouncing the user back to the login page doesn't eat into the budget. - 32k zone (~500 IPs, the minimum nginx accepts). At cache saturation an attacker rotating addresses still tops out around ~2500 attempts/min, all serialised through bcrypt one at a time. - 429 instead of the default 503 keeps the response out of the /50x.html error_page rewrite (which auto-refreshes and would loop a throttled client straight back to /login). Signed-off-by: Joachim Wiberg <troglobit@gmail.com>