Unblock an IP address from admin settings page

[BornToBeRoot]

Add a feature to unblock an ip-address from the admin settings page.

This method is far too cumbersome:
DELETE FROM oc_bruteforce_attempts WHERE ip = 'x.x.x.x';

[nickvergessen]

Maybe also via an occ command, as requested in nextcloud/server#3058

[mark-orion]

I fully support this. Please at least an occ command ASAP. People will start disabling a security feature if it is not easily to manage.

[MarkusH1975]

Please add this feature to the website, I have it running on some web space where I do not have shell access.
It should be possible to list all entries in the table and delete them item by item or just everything.
Thanks.

[MarkusH1975]

Hi,
I had again problems.
Please add a feature (show) DELETE ALL entries in oc_bruteforce_attempts.
It should work for SQLite and MySQL databases.

Thanks

[MorrisJobke]

It will be deleted on login now for that username and IP address.

[MorrisJobke]

It will be deleted on login now for that username and IP address.

See nextcloud/server#7263

[MarkusH1975]

In which release is this included ?
I have seen this issue in Nextcloud 13.0.0.

[MorrisJobke]

In which release is this included ?
I have seen this issue in Nextcloud 13.0.0.

13.0.0 - it clears the brute force logins for the combination of username and IP. So you need to login from the same machine with the same user to remove those entries.

[linucksrox]

I think that makes sense to reset the brute force attempts after successfully logging in, but in my opinion there should also be a way to do this from the occ command and from the admin interface.

The biggest problem I see with the above approach (reset after successful login) is that once you type the correct password, you still have to wait through the long delay, which in some cases it can cause timeout errors. How can you successfully log in if you get a gateway timeout?

[MorrisJobke]

How can you successfully log in if you get a gateway timeout?

You then should fix the gateway to know that there could be up to 30 seconds of delays.

[linucksrox]

Thanks @MorrisJobke, that makes sense. I didn't realize there was a maximum timeout of only 30 seconds. Actually according to https://nextcloud.com/blog/security-in-nextcloud-12-bruteforce-protection-and-rate-limiting-for-developers/ it says the timeout can go up to 60 seconds, which is still reasonable.

I just wonder if it makes sense to check the password first, then skip the timeout if it is successful. Brute force throttling only needs to happen when the password is incorrect I think. Would that be possible?

It's just that if the only way to reset is by asking the user to type in the right password, but they might potentially have to wait 60 seconds, that can be frustrating for them and if they mistype that one, we're in trouble.

Either way, are you still planning on implementing an alternative method of resetting this such as occ or in the interface?

[MorrisJobke]

I just wonder if it makes sense to check the password first, then skip the timeout if it is successful. Brute force throttling only needs to happen when the password is incorrect I think. Would that be possible?

This would then make the throttling useless. 😉 Because then the attacker only needs to wait a few seconds and knows if the password was correct and then could skip this request and go on to the next one.