login_attack_report 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8b0ce7e9bc1338cbbb212e7b6f70729cf0e262ba
-  data.tar.gz: 1633dc10e5260a41a49782a53e2c573690775944
+  metadata.gz: 16ea69dab7f0274301a8f1ea76aa682482fc2302
+  data.tar.gz: 3e806fab0d029bf2a2a31a23e4a5f1e866f47a16
 SHA512:
-  metadata.gz: f16bb9d808451b06d75f54e9924742122b8c225bbccb9b40f54e31469f51e0f0e27788922ba68f3ffd04f3987f30415652097e5ecefff7c603b74a1116758663
-  data.tar.gz: 2ec67fcbe53d61f68c8810fc03fb3a2da6c3adb4b65e560e87561744d6216a2f768d2e3db9025dcca4e6f60c8d3f924cfe99e3ca20ff7215fe959274b6f8e985
+  metadata.gz: 48ee0038bff9899833389b13cdfba7b80560714fcc81f034bfcf14cb87e35799e64192916d660e45ed05ede013c48ab7812e78bd1673a39f7ddfc17ae417574a
+  data.tar.gz: b08f7c6f2917db6a694d71e7988dc7c380261ec957ffb100435557ab1e9b9cb712cb5ba500c32e8f1634eeae997ac109c2703737ce4ce000b730d7be43b923c4

data/README.md

@@ -24,7 +24,16 @@ Or install it yourself as:
 
 ## Configuring
 
-/config/initializers/login_attack_report.rb
+・models  
+app/models/user.rb
+```ruby
+  devise ... , :lockable # enable devise lockable and add table column 'failed_attempts'
+  has_paper_trail  # enable paper_trail
+```
+
+
+・initializers  
+config/initializers/login_attack_report.rb
 ```ruby
 LoginAttackReport.setup do |config|
   # ログイン成功回数リミット
@@ -38,18 +47,26 @@ end
 
 モデル名をシンボルで渡すことで攻撃性のあるログインを判定します。
 
-ログイン成功回数のlimitを超えたユーザを抽出します。
+前月のログイン成功回数のlimitを超えたユーザを抽出します。  
 ※ 異常に多い場合、どこかでID/パスワードが漏れている、もしくはIDが共有されている可能性あり
 ```ruby
     LoginAttackReport::LARVersion.login_ok_limit_over(:User)
 ```
 
-ログイン失敗回数のlimitを超えたユーザを抽出します。
+
+前月のログイン失敗回数のlimitを超えたユーザを抽出します。  
 ※ 異常に多い場合、リスト型攻撃を受けている可能性あり
 ```ruby
     LoginAttackReport::LARVersion.login_ng_limit_over(:User)
 ```
 
+
+（未実装）前月のログイン元同一ipのlimitを超えたユーザを抽出します。  
+※ 失敗が多く、成功がいくつかあったら、攻撃が成功されている可能性あり
+```ruby
+    LoginAttackReport::LARVersion.ip_limit_over(:User)
+```
+
 ## Contributing
 
 1. Fork it ( https://github.com/[my-github-username]/login_attack_report/fork )

data/lib/login_attack_report/l_a_r_version_concern.rb

@@ -9,31 +9,36 @@ module LoginAttackReport
         PaperTrail::Version
           .where(item_type: model)
           .where(
-            'created_at >= ? and created_at <= ? and ' \
+            'created_at >= ? and created_at <= ? and '\
             'object_changes like \'%sign_in_count:%\'',
             Time.now.prev_month.beginning_of_month,
             Time.now.prev_month.end_of_month
-          ).group(:item_id).having("count(item_id) > #{LoginAttackReport.login_ok_limit}")
+          ).group(:item_id).having('count(item_id) > ?', LoginAttackReport.login_ok_limit)
       end
 
       def login_ng_limit_over(model)
         PaperTrail::Version
           .where(item_type: model)
           .where(
-            'created_at >= ? and created_at <= ? and ' \
-            'object_changes like \'%sign_in_count:%\'',
+            'created_at >= ? and created_at <= ? and '\
+            'object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- _\n- 0%\' and '\
+            'object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- __\n- 0%\' and '\
+            'object_changes like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:%\'',
             Time.now.prev_month.beginning_of_month,
             Time.now.prev_month.end_of_month
-          ).group(:item_id).having("count(item_id) > #{LoginAttackReport.login_ng_limit}")
+          ).group(:item_id).having('count(item_id) > ?', LoginAttackReport.login_ng_limit)
       end
 
       def ip_limit_over(model)
         alert_ip_limit_over = PaperTrail::Version
                               .where(item_type: model)
                               .where(
-                                'created_at >= ? and created_at <= ? and ' \
-                                '(object_changes like \'%sign_in_count:%\' or ' \
-                                  'object_changes like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:%\'' \
+                                'created_at >= ? and created_at <= ? and '\
+                                '(object_changes like \'%sign_in_count:%\' or '\
+                                  '(object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- _\n- 0%\' and '\
+                                    'object_changes not like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:\n- __\n- 0%\' and '\
+                                    'object_changes like \'--- !ruby/hash:ActiveSupport::HashWithIndifferentAccess\nfailed_attempts:%\''\
+                                  ')'\
                                 ')',
                                 Time.now.prev_month.beginning_of_month,
                                 Time.now.prev_month.end_of_month

data/lib/login_attack_report/version.rb

@@ -1,3 +1,3 @@
 module LoginAttackReport
-  VERSION = '0.1.1'
+  VERSION = '0.2.0'
 end

data/login_attack_report.gemspec

@@ -21,11 +21,10 @@ Gem::Specification.new do |spec|
 
   spec.required_rubygems_version = '>= 1.9.0'
 
-  spec.add_dependency 'rails', ['>= 3.0', '< 6.0']
   spec.add_dependency 'activerecord', ['>= 3.0', '< 6.0']
   spec.add_dependency 'activesupport', ['>= 3.0', '< 6.0']
   spec.add_dependency 'paper_trail', ['>= 3.0', '< 6.0']
-  spec.add_dependency 'devise', '>= 3.2.2'
+  spec.add_dependency 'devise', ['>= 3.0', '< 6.0']
 
   spec.add_development_dependency 'bundler', '~> 1.7'
   spec.add_development_dependency 'rake', '~> 10.0'

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: login_attack_report
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - taru m
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-24 00:00:00.000000000 Z
+date: 2015-06-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -31,7 +31,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '6.0'
 - !ruby/object:Gem::Dependency
-  name: activerecord
+  name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -51,7 +51,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '6.0'
 - !ruby/object:Gem::Dependency
-  name: activesupport
+  name: paper_trail
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -71,7 +71,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '6.0'
 - !ruby/object:Gem::Dependency
-  name: paper_trail
+  name: devise
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -90,20 +90,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '6.0'
-- !ruby/object:Gem::Dependency
-  name: devise
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 3.2.2
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 3.2.2
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement