blocks|key|347316|text|这可能也会影响到你真正的用户。对于ex。在像新加坡这样的国家，互联网服务提供商的数量有限，家庭用户可以使用的IP数量较少。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|347317|或者，您可以在x次尝试失败后插入验证码，以阻止脚本基数。|347318|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

This could possibly effect your genuine users too. For ex. in countries like Singapore there are limited number of ISPs and a smaller set of IPs which are available for home users.

Alternatively , you could possibly insert a captcha after x failed attempts to thwart script kiddies.

blocks|key|3340351|text|我认为您需要将计数保持在会话之外-否则，琐碎的攻击是在每次登录尝试之前清除cookie。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3340352|否则，计数和锁定是合理的-尽管一个更简单的解决方案可能是在每次登录失败之间有一个加倍的超时。即第一次登录尝试后2秒、下一次登录尝试后4秒、8秒等等。|3340353|您可以通过在超时期间拒绝登录来实现超时-即使用户提供了正确的密码-只需回复人类可读的文本，说明帐户已锁定。|3340354|还可以监控相同的ip+/不同的用户和相同的用户/不同的ip。|3340355|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

I think you'll need to keep the count outside the session - otherwise the trivial attack is to clear cookies before each login attempt.

Otherwise a count and lock-out is reasonable - although an easier solution might be to have a doubling-timeout between each login failure. i.e. 2 seconds after first login attempt, 4 seconds after next, 8 etc.

You implement the timeout by refusing logins in the timeout period - even if the user gives the correct password - just reply with human readable text saying that the account is locked-out.

Also monitor for same ip/different user and same user/different ip.

blocks|key|3340364|text|Jeff+Atwood提到了另一种方法:不是在多次尝试后锁定帐户，而是增加时间，直到允许再次尝试登录：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3340365|1st+failed+login++++no+delay
2nd+failed+login++++2+sec+delay
3rd+failed+login++++4+sec+delay
4th+failed+login++++8+sec+delay
5th+failed+login++++16+sec+delay|code-block|syntax|javascript|3340366|这将降低此保护措施被滥用于拒绝服务攻击的风险。|3340367|请参阅http://www.codinghorror.com/blog/archives/001206.html|3340368|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/users/1/jeff-atwood|1|http://www.codinghorror.com/blog/archives/001206.html^0|0|B|0|0|0|0|3|1H|1|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|F|7|10|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|11|8|@]|9|@]|C|$]]|$1|K|3|L|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]]|C|$]]|$1|M|3|-4|5|6|7|16|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]]]

<a href="https://stackoverflow.com/users/1/jeff-atwood">Jeff Atwood</a> mentioned another approach: Rather than locking an account after a number of attempts, increase the time until another login attempt is allowed:

<pre><code>1st failed login no delay
2nd failed login 2 sec delay
3rd failed login 4 sec delay
4th failed login 8 sec delay
5th failed login 16 sec delay
</code></pre>

That would reduce the risk that this protection measure can be abused for denial of service attacks.

See <a href="http://www.codinghorror.com/blog/archives/001206.html" rel="noreferrer">http://www.codinghorror.com/blog/archives/001206.html</a>

blocks|key|352469|text|你想做的最后一件事是把所有不成功的登录尝试都存储在一个数据库中，这将足够好地工作，但也会使DDOS攻击变得非常微不足道，从而使你的数据库服务器瘫痪。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|352470|您可能正在are服务器上使用某种类型的服务器端缓存，memcached或类似的。这些都是通过IP地址和/或用户名跟踪失败尝试的完美系统。如果失败的登录尝试超过了某个阈值，那么您可以决定停用数据库中的帐户，但您将为不需要保留的失败登录计数器保存对持久存储的大量读取和写入。|352471|如果你试图阻止人们进行暴力强制认证，像Gumbo建议的节流系统可能效果最好。它将使攻击者对暴力暴力攻击失去兴趣，同时在正常情况下甚至在攻击进行时将对合法用户的影响降至最低。我建议只计算memcached或类似的IP不成功的尝试，如果你成为极端分布式暴力暴力攻击的目标，你总是可以选择也开始跟踪每个用户名的尝试，假设攻击者实际上经常尝试相同的用户名。*只要尝试不是非常分散的，由于仍然来自数量可观的IP地址，初始的按IP代码应该足以阻止攻击者。|352472|防止来自IP地址数量有限的国家的访问者出现问题的关键是不要将阈值设置得太严格；如果您在几秒钟内没有收到多次尝试，您可能不必太担心re。脚本暴力。如果你更关心的是有人试图手动破解其他用户的密码，你可以通过用户名为后续失败的登录尝试设置更宽的界限。|352473|另一个建议，虽然没有回答你的问题，但有一定的相关性，那就是对你的最终用户实施一定级别的密码安全保护。我不会过分要求大小写混合的密码，至少x个字符，非字典等，因为你不想在人们还没有注册的时候给他们带来太多麻烦，但简单地阻止人们使用他们的用户名作为密码应该会对保护你的服务和用户免受最简单的攻击(猜猜他们为什么叫他们蛮力;)有很大的帮助。|352474|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|O|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

The last thing you want to do is storing all unsuccessful login attempts in a database, that'll work well enough but also makes it extremely trivial for DDOS attacks to bring your database server down.

You are probably using some type of server-side cache on your webserver, memcached or similar. Those are perfect systems to use for keeping track of failed attempts by IP address and/or username.  If a certain threshold for failed login attempts is exceeded you can then decide to deactivate the account in the database, but you'll be saving a bunch of reads and writes to your persisted storage for the failed login counters that you don't need to persist.

If you're trying to stop people from brute-forcing authentication, a throttling system like Gumbo suggested probably works best.  It will make brute-force attacks uninteresting to the attacker while minimizing impact for legitimate users under normal circumstances or even while an attack is going on.  I'd suggest just counting unsuccessful attempts by IP in memcached or similar, and if you ever become the target of an extremely distributed brute-force attack, you can always elect to also start keeping track of attempts per username, assuming that the attackers are actually trying the same username often.  As long as the attempt is not extremely distributed, as in still coming from a countable amount of IP addresses, the initial by-IP code should keep attackers out pretty adequately.

The key to preventing issues with visitors from countries with a limited number of IP addresses is to not make your thresholds too strict; if you don't receive multiple attempts in a couple of seconds, you probably don't have much to worry about re. scripted brute-forcing.  If you're more concerned with people trying to unravel other user's passwords manually, you can set wider boundaries for subsequent failed login attempts by username.

One other suggestion, that doesn't answer your question but is somewhat related, is to enforce a certain level of password security on your end-users.  I wouldn't go overboard with requiring a mixed-case, at least x characters, non-dictionary, etc. etc. password, because you don't want to bug people to much when they haven't even signed up yet, but simply stopping people from using their username as their password should go a very long way to protect your service and users against the most unsophisticated – guess why they call them brute-force ;) – of attacks.

blocks|key|3340438|text|可接受的答案会在连续的登录尝试中插入越来越多的延迟，根据它的实现方式，它在ASP.NET中的性能可能会非常差。ASP.NET使用线程池为请求提供服务。一旦这个线程池耗尽，传入的请求将被排队，直到有线程可用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3340439|如果使用Thread.Sleep(n)插入延迟，则会在延迟期间占用一个ASP.NET线程池线程。此线程将不再可用于执行其他请求。在这种情况下，一个简单的DOS风格的攻击就是不断提交您的登录表单。最终，每个可用于执行请求的线程都将处于休眠状态(并且持续时间越来越长)。|3340440|我能想到的正确实现这种延迟机制的唯一方法是使用异步HTTP处理程序。参见Walkthrough:+Creating+an+Asynchronous+HTTP+Handler。实现可能需要：|offset|length|3340441|3340442|在BeginProcessRequest期间尝试身份验证，并确定失败时的延迟|ordered-list-item|3340443|返回一个IAsyncResult，该WaitHandle将在延迟|3340444|之后触发。|3340445|确保已在EndProcessRequest|3340446|中触发(或阻止，直到触发)+WaitHandle|3340447|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/ms227433.aspx^0|0|0|10|1E|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|13|8|@]|9|@$F|14|G|15|1|16]]|A|$]]|$1|H|3|-4|5|6|7|17|8|@]|9|@]|A|$]]|$1|I|3|J|5|K|7|18|8|@]|9|@]|A|$]]|$1|L|3|M|5|K|7|19|8|@]|9|@]|A|$]]|$1|N|3|O|5|K|7|1A|8|@]|9|@]|A|$]]|$1|P|3|Q|5|K|7|1B|8|@]|9|@]|A|$]]|$1|R|3|S|5|6|7|1C|8|@]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1D|8|@]|9|@]|A|$]]]|U|$V|$5|W|X|Y|A|$Z|10]]]]

The accepted answer, which inserts increasing delays into successive login attempts, may perform very poorly in ASP.NET depending on how it is implemented. ASP.NET uses a thread pool to service requests. Once this thread pool is exhausted, incoming requests will be queued until a thread becomes available.

If you insert the delay using Thread.Sleep(n), you will tie up an ASP.NET thread pool thread for the duration of the delay. This thread will no longer be available to execute other requests. In this scenario a simple DOS style attack would be to keep submitting your login form. Eventually every thread available to execute requests will be sleeping (and for increasing periods of time).

The only way I can think of to properly implement this delay mechanism is to use an asynchronous HTTP handler. See <a href="http://msdn.microsoft.com/en-us/library/ms227433.aspx" rel="noreferrer">Walkthrough: Creating an Asynchronous HTTP Handler</a>. The implementation would likely need to:

<ol>
<li>Attempt authentication during BeginProcessRequest and determine the delay upon failure</li>
<li>Return an IAsyncResult exposing a WaitHandle that will be triggered after the delay</li>
<li>Make sure the WaitHandle has been triggered (or block until it has been) in EndProcessRequest</li>
</ol>

(This is in principal a language-agnostic question, though in my case I am using ASP.NET 3.5)

I am using the standard ASP.NET <a href="http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.login.aspx" rel="noreferrer">login control</a> and would like to implement the following failed login attempt throttling logic.

<ul>
<li>Handle the <a href="http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.login.loginerror.aspx" rel="noreferrer"><code>OnLoginError</code></a> event and maintain, in <a href="http://msdn.microsoft.com/en-us/library/ms972429.aspx" rel="noreferrer">Session</a>, a count of failed login attempts</li>
<li>When this count gets to [some configurable value] block further login attempts from the originating IP address or for that user / those users for 1 hour</li>
</ul>

Does this sound like a sensible approach? Am I missing an obvious means by which such checks could be bypassed?

Note: ASP.NET Session is associated with the user's browser using a cookie

<h2>Edit</h2>

This is for an administration site that is only going to be used from the UK and India

Throttling login attempts

身份验证

验证码

数据库

服务器

(这在原则上是一个与语言无关的问题，尽管在我的例子中我使用的是ASP.NET 3.5)我正在使用标准的ASP.NET ，并希望实现以下失败的登录尝试节流逻辑。处理事件，并在中维护的失败登录尝试计数，当此计数达到某个可配置值时，会阻止来自始发IP地址或该用户/那些用户的进一步登录尝试，持续1小时的这听起来像是一种明智的方...

问限制登录尝试
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问限制登录尝试EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问限制登录尝试
EN