You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/04/03 19:49:06 UTC
[I] Documentation Does Not Describe Failed Authentication Monitoring and Alerting (tooling-trusted-releases)
asf-tooling opened a new issue, #1110:
URL: https://github.com/apache/tooling-trusted-releases/issues/1110
**ASVS Level(s):** L1
**Description:**
### Summary
While the code includes authentication failure logging (log.warning, log.failed_authentication with structured metadata), the documentation does not describe how these logs are monitored, what alerting thresholds exist, or how operators should respond to attack patterns. Operations teams cannot determine proper monitoring configuration from documentation alone. Security events may go undetected without documented alerting thresholds and incident response procedures are unclear.
### Details
The file `security/ASVS/audit_guidance/authentication-security.md` does not document monitoring and alerting procedures. Authentication failure logging exists in `atr/storage/writers/tokens.py` at lines 105-116, but operational guidance is missing.
### Recommended Remediation
Add a 'Monitoring and Detection' section to `authentication-security.md` documenting:
- Authentication failure logging with structured metadata (reason, asf_uid, remote_addr, timestamp)
- Log locations
- Recommended monitoring thresholds:
- Sustained rate limit violations >10 HTTP 429 from single IP in 1 hour
- Failed PAT validations >5 for single user in 1 hour
- Account status failures
- SSH authentication failures >20 from single IP in 10 minutes
- Incident response procedures for sustained authentication failures
### Acceptance Criteria
- [ ] Monitoring section added to documentation
- [ ] Alerting thresholds documented
- [ ] Incident response procedures documented
- [ ] Log locations and formats documented
### References
- Source reports: L1:6.1.1.md
- Related findings: FINDING-128
- ASVS sections: 6.1.1
### Priority
Low
---
---
**Triage notes:** discussion - detecting brute force
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Documentation Does Not Describe Failed Authentication Monitoring and Alerting (tooling-trusted-releases)
Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg closed issue #1110: Documentation Does Not Describe Failed Authentication Monitoring and Alerting
URL: https://github.com/apache/tooling-trusted-releases/issues/1110
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Documentation Does Not Describe Failed Authentication Monitoring and Alerting (tooling-trusted-releases)
Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg commented on issue #1110:
URL: https://github.com/apache/tooling-trusted-releases/issues/1110#issuecomment-4266747265
Documented in b62b8544
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org