Feature request: Send mail even if username was not found

+1

@ageibert

Could you post as an example the content of such a “hacking attempt mail” ?
I just want to make sure we are talking about the same email.
Currently I’m assuming this topic is about this email (but I could be wrong):

Dear Site Admin,

A user, whatevr, has been locked out of the WordPress site at https://www.domain.com due to too many bad login attempts.

The user has been locked out until 2015-06-25 19:48:28.

To release the lockout please visit the lockouts page.

*This email was generated automatically by iThemes Security. To change your email preferences please visit the plugin settings.

dwinden

hi dwinden,
yes, this exactly the mail i’m talking about. (btw: before iThemes security switched from a public github repo to private, i contributed to exactly this mail sending mechanism/the wording in the mail ?? )

but this mail is only sent, if the username which was tried, already exists in the system.
i’d really need info about all hacking attempts regardless of an existing username.

this could be two options
– always send mails if a wrong username was tried too many times
– write to a log file if a username was tried too many times

best regards

Ok, so this topic is about the lockout email (I prefer to use iTSec terminology to avoid confusion).

I hope you don’t mind but I found it hard to believe there is no lockout email send for a lockout on a username that does not exist …

The reason why, is because in the iTSec Dashboard page (at the bottom) you can find an Active Lockouts overview including “Locked out usernames (not real users)” (= non existing usernames).

So I did a quick test doing enough bad logins, while using a non existant username, to generate a (username) lockout and … I received a lockout email …

I actually used the content of that email in my earlier post.
Username “whatevr” does not exist in my system.

So I think we are missing a piece of the puzzle …

I must add that I tweaked the Brute Force Protection settings before testing as I did not want any host lockouts to occur which would only complicate testing.
The default Settings are:

Max Login Attempts Per Host: 5
Max Login Attempts Per User: 10

I changed those to:

Max Login Attempts Per Host: 10
Max Login Attempts Per User: 3

So it took me only 3 bad logins to generate the (username) lockout (email).

dwinden

i checked this again and all i get if the username does not exist is this mail:

####
Dear Site Admin,

A host, 210.xxx.xxx.xxx, has been locked out of the WordPress site at https://nanolive.ch due to too many bad login attempts.

The host has been locked out permanently .

*This email was generated automatically by iThemes Security. To change your email preferences please visit the plugin settings.
####

only saying, that “a host” is locked out. but no word about the username that was tried.
do you really get a mail with the (non existing) username in it?

additionally this only happens after the “Max Login Attempts Per Host”. i and others would prefer every bad login attempt to be logged.

Ok, I think we’ve found the missing piece of the puzzle …

You only get a host lockout email with the user(name) listed when the bad login attempts reach both the value of the “Max Login Attempts Per Host” AND the value of the “Max Login Attempts Per User” setting (within the check period).
I know it is possible because I’ve seen such lockout emails in the past. Though I will need to test using a non existing username to make sure it also works in that scenario … (I know it works with an existing user).

Since the default values (5 and 10) are different for both settings chances are slim to meet both max values at the same time …
Lower the “Max Login Attempts Per User” setting to 5 and things should improve …(theoretically).

I think what you want (correct me if I’m wrong) is that the user(name)s used in the bad login attempts that generate a host lockout is\are ALSO listed in the host lockout email even when the “Max Login Attempts Per User” threshold has not been reached yet.

However there is no point in doing so as the user(name) could be different for every bad login attempt that leads to a host lockout.

As an example. Using a single computer these 2 scenarios both generate a host lockout(email):

Username: Test1
Password: test

Username: Test1
Password: test

Username: Test1
Password: test

Username: Test1
Password: test

Username: Test1
Password: test

or:

Username: Test1
Password: test

Username: Test2
Password: test

Username: Test3
Password: test

Username: Test4
Password: test

Username: Test5
Password: test

In scenario 1 it would make sense to report username Test1 in the host lockout email. This can actually be achieved by setting “Max Login Attempts Per Host” = “Max Login Attempts Per User”.
But in scenario 2 I don’t see the point of reporting 5 different usernames in the host lockout email.
Note that it is possible to lookup the user(names) used as this info is logged as part of the Invalid Login Attempts entries on the iTSec plugin Logs page.

If you are looking for full good\bad login monitoring\auditing use another Security plugin like Sucuri Security – Auditing, Malware Scanner and Hardening.

dwinden

yes, that’s the point. i’d like to be informed about every single bad login.
this seems not possible now in iThemesSec so i wanted to report this as a feature request.

If this feature will never be implemented in iThemesSec, i really have to use another additional plugin like the one suggested by you.

So: Is this a feature request which may be implemented in iThemesSecurity or will this never happen, because it’s better made by another plugin?

I haven’t tried this myself but in theory it should be possible to tweak the Brute Force Protection settings in such a way that every bad login triggers a lockout email with the username included. Not sure though whether anyone should want that … ??

But first try and set “Max Login Attempts Per Host” = “Max Login Attempts Per User”.

As a side note. I’m not an iThemes employee so I have no saying in whether a feature request is accepted\implemented or not.

In fact this is not the right place for such requests as iThemes does not actively monitor this forum (despite the occasional update to a topic) nor do they consider this forum to be a primary support channel.

For feature requests it’s better to visit these iThemes links:

https://trello.com/b/OG8BFXFY/ithemes-security-ithemes-security-pro-roadmap

https://ithemes.com/security/ithemes-security-feature-requests/

dwinden

Perfect! Thanks dwinden for all the infos. ??