PacketFence - BTS - PacketFence
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001630PacketFencesecuritypublic2013-02-12 09:552013-09-03 05:35
Reporterbemosior 
Assigned Toludovic 
PrioritynormalSeverityfeatureReproducibilityN/A
StatusassignedResolutionopen 
PlatformOSOS Version
Product Version 
Target Version+1Fixed in Version 
fixed in git revision
fixed in mtn revision
Summary0001630: Username Registration Blacklist
DescriptionWe see value in the addition of a username blacklist feature in order to prevent certain AD/LDAP registrations from occurring.

Use Case:
An individual may no longer register his/her own devices on the network (due to violations), but he/she may still use public lab machines. Disabling the AD/LDAP account is not an option, as the individual must still be able to access other services using AD/LDAP for authentication.

Workflow (my understanding of it, at least):
User attempts internet access and is redirected to the registration page. User enters username. PF compares username against blacklist, failing the process on match (with a user-facing error). In this case, no LDAP query is made/executed.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2013-02-12 09:55bemosiorNew Issue
2013-02-12 09:57bemosiorNote Added: 0003298
2013-02-13 19:26ludovicTarget Version => +1
2013-02-13 19:26ludovicStatusnew => assigned
2013-02-13 19:26ludovicAssigned To => ludovic
2013-02-13 19:27ludovicNote Added: 0003299
2013-09-03 05:35dranixNote Added: 0003435

Notes
(0003298)
bemosior   
2013-02-12 09:57   
I am assuming this blacklist is maintained independently by the local PF administrators and is simply a list of disallowed usernames.
(0003299)
ludovic   
2013-02-13 19:27   
Would be easy to do in PF v4 with a per-source blacklist of IDs.
(0003435)
dranix   
2013-09-03 05:35   
I have made a script where wireless devices (MAC) are banned upon attempting to brute-force password guess (LocalDB or LDAP account).
The script runs in the background and listens to the /usr/local/pf/log/packetfence.log and keep track of failed attempts.
After 10 failed attempts, the MAC is placed in the iptables and all packets will be dropped from accessing the inline interface.

Would the developers be interested in the script?