Does Shiro provide suspicious activity detection / threat detection?

[voltron <al...@gmail.com>]

I'm reviewing the feature set of Shiro and OpenAM right now. I know OpenAM
has a suspicious activity detection feature but I'm having trouble figuring
out if Shiro provides a similar feature.

Aside from that, it looks like most of the high-level features are the same,
with differentiators being in how things are done. If there are any other
important differentiators anyone is aware of that information would also be
appreciated, but if you only have an answer for my initial question that's
perfectly fine.

Thanks in advance.



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Does-Shiro-provide-suspicious-activity-detection-threat-detection-tp7580510.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Does Shiro provide suspicious activity detection / threat detection?

[Brian Demers <br...@gmail.com>]

Not 100% on this, but at a quick glance OpenAM look more like a standalone
service (i.e. something like Atlassian's CROWD).  So I'm not sure this
would be an apples to apples comparison.

On Wed, Apr 22, 2015 at 8:25 PM, voltron <al...@gmail.com> wrote:

> I think you're on the right track with the suggestion to create our own
> Authentication class. I'm not well versed in Shiro yet but it would be a
> custom version of one (or more) of the related classes. I'm not terribly
> concerned about implementing these features myself as needed, I just didn't
> want to reinvent the wheel if there were similar capabilities provided
> within Shiro.
>
> Thanks!
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Does-Shiro-provide-suspicious-activity-detection-threat-detection-tp7580510p7580519.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

Re: Does Shiro provide suspicious activity detection / threat detection?

[voltron <al...@gmail.com>]

I think you're on the right track with the suggestion to create our own
Authentication class. I'm not well versed in Shiro yet but it would be a
custom version of one (or more) of the related classes. I'm not terribly
concerned about implementing these features myself as needed, I just didn't
want to reinvent the wheel if there were similar capabilities provided
within Shiro.

Thanks!



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Does-Shiro-provide-suspicious-activity-detection-threat-detection-tp7580510p7580519.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Does Shiro provide suspicious activity detection / threat detection?

[KonradZuse <Th...@hotmail.com>]

I tried replying via email, but for some reason I don't see my reply here on
the forum so I'm going to post again.  If I randomly post it twice sorry for
the double post!



I'm not 100% sure, but wouldn't you just create your own Authentication
class instead of the default Form Authentication Filter?  

I would assume you could put all the data in the class and then set it what
you want in the ini file.

so if you want to login multiple times it will just have a counter going in
your class and then will do w/e after th max amount.

as for IPs and such I don't know whee you check that with Shiro, or Java,
but I'm sure it isn't that hard.

Cookies not too sure what data you can get from a Cookie check, but that
again would go in your Java Class.


As for everything else that again will have to be created in your class.


http://shiro.apache.org/webapp-tutorial.html#step3


shiro.* lines
At the top of the [main] section, there is a new line:
shiro.loginUrl = /login.jsp
This is a special configuration directive that tells Shiro “For any of
Shiro’s default filters that have a loginUrl property, I want that property
value to be set to /login.jsp.”
This allows Shiro’s default authc filter (by default, a
FormAuthenticationFilter) to know about the login page. This is necessary
for the FormAuthenticationFilter to work correctly.


http://shiro.apache.org/web.html#Web-DefaultFilters

http://shiro.apache.org/static/1.2.1/apidocs/org/apache/shiro/web/filter/authc/FormAuthenticationFilter.html



I haven't dabbled in this, but I had a buddy who did his own auth using JSF
with Shiro.



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Does-Shiro-provide-suspicious-activity-detection-threat-detection-tp7580510p7580515.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Does Shiro provide suspicious activity detection / threat detection?

[voltron <al...@gmail.com>]

That's a good clarification. I'm new to configuring server security, so I
guess a better question is "what kind of suspicious activity / threat
detection does Shiro provide, if any?" and then I can compare that against
what other products provide (if any). That's obviously a bigger question. If
there is any documentation that describes this (which I was unable to find)
a link to that would be perfectly fine.

Being able to configure Shiro to detect multiple login attempts and throw an
exception if a threshold is exceeded within a certain amount of time is a
good example of the kind of protection I'm thinking of.

Upon further reading, OpenAM's /Adaptive Authentication Module/ provides the
following features:
- Failed Authentication Check (has there been a failed attempt to
authenticate since the last success)
- IP Address Range Check
- IP Address History Check (is the user logging in from a new IP address
they have not used before?)
- Known Cookie Check (check for arbitrary cookie in the client)
- Time Since Last Login Check
- Profile Attribute Check (if the user specified has a specified attribute
on their profile, flag it)
- Geolocation Check
- Request Header Check

Each of these can be configured with various values. When any configured
rule is violated it adds points to a total score for the user and if it
exceeds a threshold then the authentication attempt is rejected and a second
form of authentication is required.

Granted, a lot of the examples from OpenAM can be coded manually, but it
would be nice if there was a module that could easily be configured for
these kinds of checks.



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Does-Shiro-provide-suspicious-activity-detection-threat-detection-tp7580510p7580514.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Does Shiro provide suspicious activity detection / threat detection?

[Brian Demers <br...@gmail.com>]

What type of suspicious activity detection are you looking for?

Something like max login attempts?
http://shiro-user.582556.n2.nabble.com/ExcessiveAttemptsException-How-to-configure-td4534742.html

DOS attacks?

Depending on what you are looking for it also might be appropriate to
monitor this from the outside of your JVM (e. g. at a load balancer)

On Mon, Apr 20, 2015 at 1:33 PM, voltron <al...@gmail.com> wrote:

> I'm reviewing the feature set of Shiro and OpenAM right now. I know OpenAM
> has a suspicious activity detection feature but I'm having trouble figuring
> out if Shiro provides a similar feature.
>
> Aside from that, it looks like most of the high-level features are the
> same,
> with differentiators being in how things are done. If there are any other
> important differentiators anyone is aware of that information would also be
> appreciated, but if you only have an answer for my initial question that's
> perfectly fine.
>
> Thanks in advance.
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Does-Shiro-provide-suspicious-activity-detection-threat-detection-tp7580510.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>