Fake connections to WebClient

[grahamg]

One of my SV7.4 WebClient solutions occasionally gets a large number of connections from the same IP address.

They appear to be just sitting on the Login screen until timed-out and closed. However a 15 minute time-out is useless since they were coming in at 5 sec intervals - see screenshot. Have reported it to [email protected] and other reports indicate it is a robots.txt crawler.

Looking at adding some code to check if the same IP address is connecting multiple times but wondering if others have suffered and resolved the same problem.


Cheers

GrahamG

[swingman]

Hi Graham,

Not familiar with the web-client, but you could check the IP-address of the user login in and if there is a failed attempt delay for let's say 2 seconds.
The second time there is a failed attempt from that IP address or username, you double the delay and so on...
Within a few attempts the intruder will be encouraged to give up...

For something else I use this (will not work with Servoy, but may give you some evil ideas):

https://github.com/kickstarter/rack-attack

[grahamg]

Hi Christian

Thanks for that link. Was thinking along similar lines but like the idea of doubling the delay each time

They are not trying to Login - possibly just a badly setup Crawler - but I can certainly monitor and close them down after a short period.

Thanks again.

Graham