http://hg.omfa.de/prosody-modules/ en-us prosody-modules: mod_audit_auth/mod_audit_auth.lua history mod_audit_auth/mod_audit_auth.lua revision history mod_audit_auth: Allow suppressing repeated failure/success log entries from the same IP for a time http://hg.omfa.de/prosody-modules/log/cc30c4b5f006/mod_audit_auth/mod_audit_auth.lua
This can be triggered by e.g. a distributed brute force attack, or from Monal.]]> Matthew Wild <mwild1@gmail.com> Mon, 13 May 2024 18:30:18 +0100 mod_audit_auth: Improve user-agent building (fixes traceback) http://hg.omfa.de/prosody-modules/log/f199bff16f1f/mod_audit_auth/mod_audit_auth.lua Matthew Wild <mwild1@gmail.com> Thu, 07 Dec 2023 13:02:36 +0000 mod_audit_auth: Add audit record when a client connects that has not been seen before http://hg.omfa.de/prosody-modules/log/238c4ac8b735/mod_audit_auth/mod_audit_auth.lua Matthew Wild <mwild1@gmail.com> Fri, 01 Dec 2023 11:59:02 +0000 mod_audit_auth: Ignore FAST authentication events by default http://hg.omfa.de/prosody-modules/log/dfbced5e54b9/mod_audit_auth/mod_audit_auth.lua
FAST is more like a cookie that allows linking new connections to a previous
(e.g. password) authentication. Since we assume that FAST tokens are secure
(not user generated) and not shareable, it reduces a lot of noise by filtering
out uninteresting authentication events.]]> Matthew Wild <mwild1@gmail.com> Fri, 01 Dec 2023 11:34:52 +0000 mod_audit_auth: Include hostpart with audit events http://hg.omfa.de/prosody-modules/log/b357ff3d0c8a/mod_audit_auth/mod_audit_auth.lua
mod_audit seems to expect this to be JIDs, not bare usernames.]]> Kim Alvefur <zash@zash.se> Mon, 13 Nov 2023 17:14:09 +0100 mod_audit*: fix luacheck warnings http://hg.omfa.de/prosody-modules/log/08dea42a302a/mod_audit_auth/mod_audit_auth.lua Jonas Schäfer <jonas@wielicki.name> Tue, 26 Apr 2022 22:37:13 +0200 mod_audit*: modules for audit logging in prosody http://hg.omfa.de/prosody-modules/log/530d116b7f68/mod_audit_auth/mod_audit_auth.lua
These are to be seen as proof-of-concept for now.]]> Jonas Schäfer <jonas@wielicki.name> Tue, 26 Apr 2022 22:32:44 +0200