Vault 8305 Prevent Brute Forcing in Auth methods : Setting user lockout configuration #17338

akshya96 · 2022-09-27T21:47:36Z

Jira: https://hashicorp.atlassian.net/browse/VAULT-8305
RFC: https://docs.google.com/document/d/1ypCRDMrjmKkElN51PcRSHJtyYNmolhdTu_M_EkPPv5U/edit?usp=sharing
Includes:
Adding user lockout configuration for each auth method using config file
Modifying user lockout configuration for each auth mount using auth tune cli and api

Example of user lockout in config file:
user_lockout "all" {
lockout_threshold = "25"
lockout_duration = "40m"
lockout_counter_reset = "45m"
disable_lockout = "false"
}
user_lockout "userpass" {
lockout_threshold = "100"
lockout_duration = "20m"
}

hghaf099

I have not gone through the entire review yet. It is a nice work! Some comments and questions.

api/sys_mounts.go

command/auth_tune.go

internalshared/configutil/userlockout.go

internalshared/configutil/userlockout_test.go

vault/mount.go

vault/logical_system_paths.go

vault/logical_system.go

changelog/17338.txt

internalshared/configutil/userlockout.go

sdk/helper/consts/consts.go

api/sys_mounts.go

changelog/17338.txt

command/auth_tune.go

internalshared/configutil/userlockout.go

hghaf099 · 2022-10-04T20:02:14Z

internalshared/configutil/userlockout.go

+ }
+
+ }
+ if userLockoutConfig.DisableLockoutRaw != nil {


The raw entries in this function are parsed if they are non-nil. I believe we have this practice in parsing config options that if a raw entry is parsed, it is being set to nil afterwards. Would you think doing the same would be better for consistency? I do notice that these raw values are relied upon to set default values in setMissingUserLockoutValuesInMap function. But, those logics could be changed to checking the non-raw entries and if they have not set before, setting them to the default values.

Yes, I agree that the usual way is to set nil for 'raw' values as soon as they are parsed. The issue with checking non-raw entries is because of fields lockout threshold (uint) and disable lockout (bool). It will be difficult to figure out if the user configured lockout threshold with value 0 or if the user did not configure this value at all. In case of other configurations like Listeners, we append values after the parse but in this case, we parse through the map values to set default values for each "type" mentioned in config in result.UserLockouts.

One way to get away from this is set these values to defaults before parsing raw values. But, I guess then there are values that are populated by all type.

hghaf099 · 2022-10-04T21:20:30Z

vault/logical_system.go

+ switch apiuserLockoutConfig.LockoutCounterResetDuration {
+ case "":
+ newUserLockoutCounterReset = oldUserLockoutCounterReset
+ case "system":


Just out of curiosity, what does "system" mean here? Why would the value for counter reset be passed in as system?

And, Is there a default value for the counter reset? or time.Duration(0) is the default value?

In command/auth_tune.go , we set lockout duration as LockoutDuration = ttlToAPI(c.flagUserLockoutDuration). ttlToApi converts user-supplied ttl into an API-compatible string. If the TTL is 0, this returns the empty string. If the TTL is negative, this returns "system" to indicate to use the system values. Otherwise, the time.Duration ttl is used. In the api part, if we do not have any values for this string, we use the already existing values that is present in the entry. If the string is system, we set time.Duration(0) else we use the input ttl.

Yes, we have a default value of 15 minutes for lockout duration and lockout counter reset if not configured by the user using config file / auth tune.

vault/logical_system.go

vault/mount.go

vault/request_handling.go

ccapurso

I have similar thoughts to some of the comments that @hghaf099 made. Will keep an eye on those threads. Looks good though.

hghaf099

Some minor follow ups. Nice work!

internalshared/configutil/config.go

changelog/17338.txt

internalshared/configutil/config.go

hghaf099 · 2022-10-18T15:11:58Z

internalshared/configutil/userlockout.go

+ }
+
+ }
+ if userLockoutConfig.DisableLockoutRaw != nil {


One way to get away from this is set these values to defaults before parsing raw values. But, I guess then there are values that are populated by all type.

internalshared/configutil/userlockout.go

hghaf099

I added some minor comments. The code looks good to me!

hghaf099 · 2022-10-31T19:48:30Z

command/server/config_test_helpers.go

+ {
+ Type: "all",
+ LockoutThreshold: 5,
+ LockoutThresholdRaw: nil,


nit: Would you think removing the nil values here would help readability? Seems like they are unnecessary.

The test would failed if we remove this as it compares with what the values in SharedConfig would look like.

I see. I am curious to know what is the failure. The zero value for an interface is nil, so if you don't set it nil explicitly, it should still be nil, no?

Sorry, the test was flaky before and the comparison failed for config and expected config sometimes due to arrangement of array elements. When I removed raw entries then, the comparison failed and I felt it was because of that. I think the flaky test fix fixed that and on removing the nil fields, the comparison is successful.

internalshared/configutil/userlockout.go

vault/logical_system.go

ccapurso

Looks good!

mladlow · 2022-11-04T20:30:35Z

changelog/17338.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+core: Add user lockout field to config and configuring this for auth mount using auth tune to prevent brute forcing in auth methods 


@akshya96 - I left a comment on the enterprise PR as well - for new features, they only need one changelog entry per new feature. If you want to make separate changelog entries per PR, those entries shouldn't be in the "features" section (and you may or may not need to make separate additional changelog entries).

For new features, they have a different format for changelog entries. Could you please open a new PR (or use the enterprise PR) to consolidate the changelog entries for this feature and change the formatting?

…ut configuration (hashicorp#17338) * config file changes * lockout config changes * auth tune r/w and auth tune * removing changes at enable * removing q.Q * go mod tidy * removing comments * changing struct name for config file * fixing mount tune * adding test file for user lockout * fixing comments and add changelog * addressing comments * fixing mount table updates * updating consts in auth_tune * small fixes * adding hcl parse test * fixing config compare * fixing github comments * optimize userlockouts.go * fixing test * minor changes * adding comments * adding sort to flaky test * fix flaky test

akshya96 added 8 commits September 15, 2022 13:37

config file changes

8409d7b

lockout config changes

f4503ae

auth tune r/w and auth tune

9fc0fa2

removing changes at enable

77aeee3

removing q.Q

555e350

go mod tidy

4cbf934

removing comments

fd216b1

resolving main conflicts

cac705c

vercel bot deployed to Preview September 27, 2022 23:48 View deployment

akshya96 added 4 commits September 27, 2022 17:19

changing struct name for config file

9219b54

fixing mount tune

95bf91d

adding test file for user lockout

7ee7a1e

fixing comments and add changelog

d8be9b5

akshya96 changed the title ~~Vault 8305 lockout config~~ Vault 8305 Prevent Brute Forcing in Auth methods : Add user lockout in config Sep 28, 2022

akshya96 changed the title ~~Vault 8305 Prevent Brute Forcing in Auth methods : Add user lockout in config~~ Vault 8305 Prevent Brute Forcing in Auth methods : Setting user lockout configuration Sep 28, 2022

akshya96 marked this pull request as ready for review September 28, 2022 23:22

akshya96 requested review from raskchanky, ncabatoff, mpalmi, VioletHynes, hghaf099 and ccapurso September 28, 2022 23:23

hghaf099 reviewed Sep 30, 2022

View reviewed changes

ccapurso reviewed Sep 30, 2022

View reviewed changes

changelog/17338.txt Outdated Show resolved Hide resolved

internalshared/configutil/userlockout.go Show resolved Hide resolved

internalshared/configutil/userlockout.go Show resolved Hide resolved

sdk/helper/consts/consts.go Show resolved Hide resolved

akshya96 added 5 commits October 3, 2022 21:42

addressing comments

0616553

fixing mount table updates

3b9f1df

updating consts in auth_tune

817e4ff

small fixes

d3eca3b

adding hcl parse test

d66876c

akshya96 requested a review from hghaf099 October 4, 2022 18:11

akshya96 requested a review from ccapurso October 4, 2022 18:11

merging changes from main

ae85e5d

vercel bot deployed to Preview October 4, 2022 18:22 View deployment

fixing config compare

315084d

hghaf099 reviewed Oct 4, 2022

View reviewed changes

ccapurso reviewed Oct 6, 2022

View reviewed changes

akshya96 added 3 commits October 6, 2022 15:11

fixing github comments

3076956

optimize userlockouts.go

4aff75d

fixing test

9699169

hghaf099 reviewed Oct 18, 2022

View reviewed changes

minor changes

916b372

akshya96 requested review from ccapurso and hghaf099 October 27, 2022 18:41

hghaf099 approved these changes Oct 31, 2022

View reviewed changes

akshya96 added 2 commits October 31, 2022 15:04

adding comments

7f6305a

Merge branch 'main' into Vault-8305LockoutConfig

9b1674b

vercel bot deployed to Preview October 31, 2022 23:56 View deployment

akshya96 added 2 commits October 31, 2022 17:45

adding sort to flaky test

17813cd

fix flaky test

fdb5248

ccapurso approved these changes Nov 1, 2022

View reviewed changes

akshya96 merged commit 746b089 into main Nov 1, 2022

mladlow reviewed Nov 4, 2022

View reviewed changes

akshya96 mentioned this pull request Nov 7, 2022

Fix changelog for vault-8305 #17843

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vault 8305 Prevent Brute Forcing in Auth methods : Setting user lockout configuration #17338

Vault 8305 Prevent Brute Forcing in Auth methods : Setting user lockout configuration #17338

akshya96 commented Sep 27, 2022 •

edited

Loading

hghaf099 left a comment

hghaf099 Oct 4, 2022

akshya96 Oct 7, 2022

hghaf099 Oct 18, 2022

hghaf099 Oct 4, 2022

hghaf099 Oct 4, 2022

akshya96 Oct 7, 2022

akshya96 Oct 7, 2022 •

edited

Loading

ccapurso left a comment

hghaf099 left a comment

hghaf099 Oct 18, 2022

hghaf099 left a comment

hghaf099 Oct 31, 2022

akshya96 Oct 31, 2022

hghaf099 Oct 31, 2022

akshya96 Nov 1, 2022

ccapurso left a comment

mladlow Nov 4, 2022

		@@ -0,0 +1,3 @@
		```release-note:feature
		core: Add user lockout field to config and configuring this for auth mount using auth tune to prevent brute forcing in auth methods

Vault 8305 Prevent Brute Forcing in Auth methods : Setting user lockout configuration #17338

Vault 8305 Prevent Brute Forcing in Auth methods : Setting user lockout configuration #17338

Conversation

akshya96 commented Sep 27, 2022 • edited Loading

hghaf099 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

akshya96 Oct 7, 2022 • edited Loading

Choose a reason for hiding this comment

ccapurso left a comment

Choose a reason for hiding this comment

hghaf099 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hghaf099 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ccapurso left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

akshya96 commented Sep 27, 2022 •

edited

Loading

akshya96 Oct 7, 2022 •

edited

Loading