login_attack_report 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 16ea69dab7f0274301a8f1ea76aa682482fc2302
-  data.tar.gz: 3e806fab0d029bf2a2a31a23e4a5f1e866f47a16
+  metadata.gz: aed0e5b2c8aaae617526b72998435350d390f0e1
+  data.tar.gz: 280d7d988f0a2e55971bc5bd1bc9ca4d3a27922f
 SHA512:
-  metadata.gz: 48ee0038bff9899833389b13cdfba7b80560714fcc81f034bfcf14cb87e35799e64192916d660e45ed05ede013c48ab7812e78bd1673a39f7ddfc17ae417574a
-  data.tar.gz: b08f7c6f2917db6a694d71e7988dc7c380261ec957ffb100435557ab1e9b9cb712cb5ba500c32e8f1634eeae997ac109c2703737ce4ce000b730d7be43b923c4
+  metadata.gz: 3d5f5e64e82993a4283d56c3b65ac35167a40c77c3493e0269e435e298999f344599d980a5efd39b70de3e743767e1374ce399d6c8c3da74e561686b9de73b25
+  data.tar.gz: 1f6e7482f5fd953df7f663389ee12082f9d333eb5aec83b315d8a2851a3150d4796cb7baccf9c886e8383e9c6e258339e0ba58661ddb8a793585a65757e1dd04

data/README.md

@@ -37,9 +37,11 @@ config/initializers/login_attack_report.rb
 ```ruby
 LoginAttackReport.setup do |config|
   # ログイン成功回数リミット
-  config.login_ok_limit = 200
+  config.login_ok_limit = 100
   # ログイン失敗回数リミット
   config.login_ng_limit = 50
+  # 同一IPログイン失敗回数リミット
+  config.same_ip_login_ng_limit = 100
 end
 ```
 
@@ -52,17 +54,17 @@ end
 ```ruby
     LoginAttackReport::LARVersion.login_ok_limit_over(:User)
 ```
-
+  
 
 前月のログイン失敗回数のlimitを超えたユーザを抽出します。  
 ※ 異常に多い場合、リスト型攻撃を受けている可能性あり
 ```ruby
     LoginAttackReport::LARVersion.login_ng_limit_over(:User)
 ```
-
+  
 
 （未実装）前月のログイン元同一ipのlimitを超えたユーザを抽出します。  
-※ 失敗が多く、成功がいくつかあったら、攻撃が成功されている可能性あり
+※ 同一ipでログイン失敗回数が多かったら、攻撃されている可能性あり
 ```ruby
     LoginAttackReport::LARVersion.ip_limit_over(:User)
 ```

data/lib/login_attack_report/l_a_r_version_concern.rb

@@ -34,18 +34,15 @@ module LoginAttackReport
                               .where(item_type: model)
                               .where(
                                 'created_at >= ? and created_at <= ? and '\
-                                '(object_changes like \'%sign_in_count:%\' or '\
-                                  '(object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- _\n- 0%\' and '\
-                                    'object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- __\n- 0%\' and '\
-                                    'object_changes like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:%\''\
-                                  ')'\
+                                '(object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- _\n- 0%\' and '\
+                                  'object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- __\n- 0%\' and '\
+                                  'object_changes like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:%\''\
                                 ')',
                                 Time.now.prev_month.beginning_of_month,
                                 Time.now.prev_month.end_of_month
                               )
 
         if alert_ip_limit_over.present?
-          ok_hash = Hash.new({})
           ng_hash = Hash.new({})
           alert_ip_limit_over.find_each do |version|
             # アクセス元ipアドレス取得
@@ -54,22 +51,16 @@ module LoginAttackReport
             else
               current_sign_in_ip = YAML.load(version.object)['current_sign_in_ip']
             end
-            # ログイン成功回数取得
-            if /sign_in_count/ =~ version.object_changes
-              if ok_hash[current_sign_in_ip].present?
-                ok_hash[current_sign_in_ip] += 1
-              else
-                ok_hash[current_sign_in_ip] = 1
-              end
-            # ログイン失敗回数取得
+            if ng_hash[current_sign_in_ip].present?
+              ng_hash[current_sign_in_ip] += 1
             else
-              if ng_hash[current_sign_in_ip].present?
-                ng_hash[current_sign_in_ip] += 1
-              else
-                ng_hash[current_sign_in_ip] = 1
-              end
+              ng_hash[current_sign_in_ip] = 1
             end
           end
+
+          if 
+
+          end
         end
       end
     end

data/lib/login_attack_report/version.rb

@@ -1,3 +1,3 @@
 module LoginAttackReport
-  VERSION = '0.2.0'
+  VERSION = '0.2.1'
 end

data/lib/login_attack_report.rb

@@ -1,7 +1,4 @@
 require 'login_attack_report/version'
-require 'active_support'
-require 'active_record'
-require 'paper_trail'
 
 Dir[File.join(File.dirname(__FILE__), 'login_attack_report', '*.rb')].each do |file|
   require File.join('login_attack_report', File.basename(file, '.rb'))
@@ -9,15 +6,18 @@ end
 require 'login_attack_report/frameworks/active_record'
 
 module LoginAttackReport
-
   # login ok limit
   mattr_accessor :login_ok_limit
-  @@login_ok_limit = 200
+  @@login_ok_limit = 100
 
   # login ng limit
   mattr_accessor :login_ng_limit
   @@login_ng_limit = 50
 
+  # same ip login ng limit
+  mattr_accessor :same_ip_login_ng_limit
+  @@same_ip_login_ng_limit = 100
+
   # config/initializers/login_attack_report.rb
   def self.setup
     yield self

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: login_attack_report
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - taru m
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-25 00:00:00.000000000 Z
+date: 2015-06-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord