Security Question

[Ninja Ethoroxyole <Et...@hotmail.com>]

Hi all,

Just wondered if anyone knew if Guacamole was at risk to brute force attacks?

Will it prevent a user from logging in after so many attempts, I have tested and it seems it don't but I haven't gone crazy testing it.


Cheers,

RE: Security Question

[Mike Jumper <mi...@guac-dev.org>]

On Aug 26, 2016 6:22 AM, "Paraire Andrés, Jordi Jesús" <
jjparaire@minsait.com> wrote:
>
> Hi,
>
> You can use the fail2ban tool to inspect the logs and implement some kind
of firewall blocking.
>

+1 for fail2ban. This is what we use in front of the production server at
work.

The Guacamole webapp logs failed login attempts and the originating IP, so
configuring fail2ban to temporarily block offending addresses is pretty
straightforward.

- Mike

RE: Security Question

[Paraire, Jordi Jesús <jj...@minsait.com>]

Hi,

You can use the fail2ban tool to inspect the logs and implement some kind of firewall blocking.

BR

[cid:image001.jpg@01D1FFAD.AA49E690][cid:image002.jpg@01D1FFAD.AA49E690]<https://twitter.com/minsaitbyindra>[cid:image003.jpg@01D1FFAD.AA49E690]<https://www.youtube.com/channel/UCdz8akghznOoBVd2KhFW4Qw>[cid:image004.jpg@01D1FFAD.AA49E690]<https://www.linkedin.com/company/minsait>

Jordi Jesús Paraire Andrés
Consultor Senior
Tecnologías Digitales
jjparaire@minsait.com<ma...@minsait.com>

Avda. Cardenal Benlloch, 67
46021 Valencia, España
T +34 914 805 000
M +34 607 589 078
minsait.com



De: Ninja Ethoroxyole [mailto:Ethoroxyole@hotmail.com]
Enviado el: viernes, 26 de agosto de 2016 15:21
Para: user@guacamole.incubator.apache.org
Asunto: Security Question


Hi all,

Just wondered if anyone knew if Guacamole was at risk to brute force attacks?

Will it prevent a user from logging in after so many attempts, I have tested and it seems it don't but I haven't gone crazy testing it.



Cheers,

________________________________
Este correo electrónico y, en su caso, cualquier fichero anexo al mismo, contiene información de carácter confidencial exclusivamente dirigida a su destinatario o destinatarios. Si no es vd. el destinatario indicado, queda notificado que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. En el caso de haber recibido este correo electrónico por error, se ruega notificar inmediatamente esta circunstancia mediante reenvío a la dirección electrónica del remitente.
Evite imprimir este mensaje si no es estrictamente necesario.

This email and any file attached to it (when applicable) contain(s) confidential information that is exclusively addressed to its recipient(s). If you are not the indicated recipient, you are informed that reading, using, disseminating and/or copying it without authorisation is forbidden in accordance with the legislation in effect. If you have received this email by mistake, please immediately notify the sender of the situation by resending it to their email address.
Avoid printing this message if it is not absolutely necessary.