Topic: can iredadmin record username in apache log? or throw up a captcha?
==== Required information ====
- iRedMail version: .85
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): mysql
- Linux/BSD distribution name and version: ubuntu 13.04
- Related log if you're reporting an issue:
I'm looking for a way to prevent brute force attacks on the iredadmin login. Personally I'm all for fail2ban and ip blocking, but I've been asked to look at a less heavy handed approach.
Is there any way to get iredadmin to throw up a captcha after a number of failed login attempts? Something like the rcguard plugin for roundcube.
I was also thinking of rolling my own using fail2ban or using ip banning with fail2ban with stricter requirements for admins and global admins and being lenient with regular users.
However, doing this would depend on logging the username (like roundcube)
If I get a failed login, then i get something like this in the apache logs
220.127.116.11 - - [02/Sep/2013:14:51:48 +0100] "GET /iredadmin/login?msg=INVALID_USERNAME HTTP/1.1" 200 1700 "[url]https://mail.mydomain.net/iredadmin/login[/url]" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0"
Is it possible to get the username in the apache log?