Hi everybody,
if haven’t missed something, there is no real login protection for pimatic, isn’t it?
Would be nice if we are able to set up maximum tries and increasing waiting times after every try.
Like in most router interfaces.
Regards
Partovic
-
Bruteforce / Login failed protection
-
@Partovic You’re right. There is no protection against bruteforce attacks. I have created a ticket for this along with a proof-of-concept implementation based on ‘express-brute’. It is just a first draft which may be incomplete and can be improved with respect to error handling and such.
"It always takes longer than you expect, even when you take into account Hofstadter's Law.", Hofstadter's Law
-
Needless to say that there are also other security shortcomings, in particular, if pimatic is exposed on the internet. Users should never do that without putting a reverse proxy into the loop (e.g. nginx, or apache proxy module). Unfortunately, setting up a good proxy configuration is still a bit of black art. Most of the tutorials I found are outdated or only scratch at the surface. For a basic proxy setup some useful hints can be found in some forum posts we had on the matter, e.g:
- https://forum.pimatic.org/topic/1298/solved-pimatic-with-nginx
- https://forum.pimatic.org/topic/1998/pimatic-nginx-http-2-let-s-encrypt
For pimatic developers the following article may provide a good starting point to make pimatic more bullet-proof. https://expressjs.com/en/advanced/best-practice-security.html
"It always takes longer than you expect, even when you take into account Hofstadter's Law.", Hofstadter's Law
