Locking out Accounts

This is a good idea; probably worth doing for 1.8.2 as well as 1.8.3. Blocks for per-player login attempts, and maybe track each IP address and sitelock those with more than some number of failed logins in a row...

How would you conceptually go about this? I was poking around player.c last night and thinking.

Every connection is written to connect.log with a date/time stamp. Is this as simple as checking that logfile against failed attmepts in X seconds before allowing login?

player.c (line 165) has this:

/* validate password */ if (!Guest(player))

if (!password_check(player, password)) {

/* Increment count of login failures */ Mod Time(player)++; check_lastfailed(player, host); return NOTHING;

}

I know nothing about c, but I would like to learn, and if this is that easy, I'd like to take a stab at it.

I must note that this has a possibility of being abused. If there's hate between players, a player can try to log into that person's account a few times to force it to get locked up.

I realize that the staffer would be able to figure out the IP adress of the player and thus find out who the culprit was, but I may want to suggest something higher than three? After all, if someone is running a password-hacking tool, it likely starts with using a 4-letter password and slowly works its way up.

Asuming it can be 36 types of signs, 4 characters has about 1679616 possibilities. --> 36⁴

I doubt a player who really has it in for another player will take his time to fail a connection that many times.

About 46656 failed attempts may be a good place to start? --> 36³

Yay for config options, says I. ;) It seems like a good idea, but it ought to be a simple config option like fail_attempts ... default it to -1 (the current behaviour; 'infinite'). Then you can do like fail_attempts 3 to lock out after 3 failed attempts, and so on.

I think a failed login timer would work much better than a number. Simply require a 5 second delay after a failed login attempt.

This solves the cracking problem (there are only 86400 in a day, so 17280 login attempts) as well as the annoying another user problem (no matter what, the login is available again 5 seconds after the attacking player finishes their tantrum).

This is also much easier to implement, by simply tracking the LASTFAILED attribute (which records both the IP and time of last failed connection).

Delay should be higher (say, 1 minute) for wizard accounts.

Also, the IP tracking could assign a shorter delay for a failed connection attempt from the user's last successful IP (more likely to be their own computer) than a different IP (more likely to be a cracker)