Brute Force protection doesn't appear to work

Hi,

Thanks for reporting this. Could you please file a bug report?

https://ithemes.com/security/bugs/

Thanks,

Gerroald

Gerrroald,

I filed one yesterday. You’ve sent me email. I’ve just replied and included an attachment as per your request.

Let me know how I can help you out further, I really like what you are trying to do with this plugin and want to help it succeed.

– WP Joe

report filed. ??

Nothing since the request for the bug report. But, there since 2 of the 3 days since then were Saturday and Sunday, I’m not feeling abandoned yet. Hoping to have something back from the Dev/Author by the end of the week.

Hey All,

I’ve spoken with the developer, and forwarded your emails to him. We’ve tried to replicate this, and just can’t do it. I’ll speak with him to see if there’s anymore information we can use and correspond with you through the bug report.

Thanks,

Gerroald

Hey – I am having this same issue as well. But I first noticed it when 404 errors were not triggering a lockout. I just tried the bad login and admin login, and those also do not trigger a lockout or a ban.

Question for those previously on this thread. Do you have 404 blocking enabled? And if so, is it working?

not getting any of the bans to work. ??

404 detection is turned on, honestly I have a hard time interpreting the 404 errors logged, none of the details come up when I check a specific 404 error. So I can’t tell how many times a host is hitting a particular page that triggers a 404.

I can tell you that the only banned hosts are ones that I manually put in. So that implies to me that 404 banning isn’t working. I would expect the program to add entries to the Ban Hosts table once they trigger a ban or lockout. I’ve got to believe given the number of fake admin login attempts that I’m seeing in the logs that the ‘bots would also be probing for pages with vulnerabilites, and therefore creating enough 404’s to trigger a block.

Maybe I’m misinterpreting how the 404 feature would work and perhaps it doesn’t manually add hosts to the Ban Hosts table though.

Gerroald,

I expected a request for a list of what other plugins I’m using to see if there might be a combination of elements causing this issue. I’m a little surprised that this never happened.

I’m a PC tech and I know that unexpected software results can often be caused by a combination of applications installed and interacting unintentionally with each other (historically firewalls and AntiVirus programs are most common examples of this).

Maybe web/PHP based applications/plugins don’t suffer from this sort of interactivity?

I’d rather not share a full list of plugins in use here (13 of them), but, I’d be happy to forward a list to the Dev if asked via our existing email thread if that might help with debug.

Well, separately, he did ask me to do the no-plugin test. It didn’t work. I don’t think it’s a plugin thing.

I have another WP site where brute force protection is working normally. I have the same version of WP, and the same version of ITSecurity, and they are both hosted with the same host, (so the same versions of PHP, Apache, MySql, etc.). I use many of the same plugins on both sites. I deactivated the ones that were different, so that the plugins were the same. Still, lockouts happen only on one site and not the other.

I am next going to try to see if there is some database error that happens on one site and not the other. If, for example, ITSec had some sort of MySQL error when trying to read logs, or write to the lockout table, it may go down an error path that prevents the lockout from occurring. It’s a thought anyway.

More things that don’t work:
Knowing that the versions of everything could be the same for a working and a non-working installation, I thought perhaps it was a data issue. The data in the itsec_* tables is certainly different from one install to another.

After clearing the logs, I noticed that there was still data in itsec_temp. Checking the data, it was all old stuff that could be removed.

I truncated the table itsec_temp. The other itsec_* tables were already empty. Unfortunately, it didn’t help. Errors still logged, but do not lead to a lockout.

Additionally, I checked for DB Error logs around the time I should have triggered a lockout. No luck there either.

Now, I’m wondering if there is a corrupted itsec file in my installation on just one site. I don’t know which file contains the lockout processing, but if I see one with a bad modification date, I’ll post back.

Hey guys –
I noticed tonight that file change detection wasn’t working either. That was the last straw, and so I went for the “nuclear option”.
I completely uninstalled ITSecurity.
Then I reinstalled it.
Now, it works.
Apparently, there was a corrupted file, or a major problem with the install where it left out an entry point into the WP code or something.
Anyway. Try uninstalling, and reinstalling, and then you’ll have to configure. It’s only mildly time consuming, and it worked for me.

i’ll give this a shot and report back.

thanks for workin’ on this. ??

“Automatically ban ‘admin’ user” function does not work for me either. I submitted a bug report.

I just activated the iThemes’ “Brute Force Protection” aspect of its Security Plugin and now I suddenly have 1 host locked out and 632 error pages (404 errors) to go through and fix? It’s a cruel joke – by adding protecting from brute force attacks I just attracted them.
Submitting bug report on their site – but seriously,anyone know how I can talk to a human?

Apparently the “Enable Brute Force Protection” aspect of the iThemes Security Plugin is not working. This also happened 2 days after I reset my password after iThemes notified me that their security was breached and thus I changed my password. “Automatically ban ‘admin’ user” function does not work for me either.

Any recommendations?