Better logging for failed attempts at repo migration - Brute force possible #2119

New Issue

GiteaMirror · 2025-11-02T04:24:40-06:00

GiteaMirror commented

2025-11-02 04:24:40 -06:00

Originally created by @glitch003 on GitHub (Jul 30, 2018).

Gitea version (or commit ref): 1.4.3
Git version: 2.17.1
Operating system: Ubuntu 16.04
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant

Description

A brute force attack on a user's password is possible using the migrate repo functionality. The standard advice for stopping brute force attacks on gitea is to use fail2ban (docs here: https://github.com/go-gitea/gitea/blob/master/docs/content/doc/usage/fail2ban-setup.md). However, the log message printed when an authentication attempt fails via "migrate repo" does not include the host / IP of the attacker, so it's not possible to set up fail2ban to ban the user.

The log message appears to be 2018/07/30 22:10:52 [...routers/repo/http.go:153 HTTP()] [E] invalid credentials

I think if we can have gitea log the IP, then we can add this error to the fail2ban filter in the gitea docs, and then fail2ban can handle this kind of login attempt as well.

Thanks!

Originally created by @glitch003 on GitHub (Jul 30, 2018).  - Gitea version (or commit ref): 1.4.3 - Git version: 2.17.1 - Operating system: Ubuntu 16.04 - Database (use `[x]`): - [X] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [X] Not relevant ## Description A brute force attack on a user's password is possible using the migrate repo functionality. The standard advice for stopping brute force attacks on gitea is to use fail2ban (docs here: https://github.com/go-gitea/gitea/blob/master/docs/content/doc/usage/fail2ban-setup.md). However, the log message printed when an authentication attempt fails via "migrate repo" does not include the host / IP of the attacker, so it's not possible to set up fail2ban to ban the user. The log message appears to be ```2018/07/30 22:10:52 [...routers/repo/http.go:153 HTTP()] [E] invalid credentials``` I think if we can have gitea log the IP, then we can add this error to the fail2ban filter in the gitea docs, and then fail2ban can handle this kind of login attempt as well. Thanks!

GiteaMirror added the type/enhancement topic/security labels 2025-11-02 04:24:40 -06:00

GiteaMirror closed this issue

2025-11-02 04:24:40 -06:00

GiteaMirror commented

2025-11-02 04:24:40 -06:00

@bobemoe commented on GitHub (May 10, 2019):

This appears to be the same for a HTTP git clone or fetch. 2019/05/10 09:46:29 [...routers/repo/http.go:211 HTTP()] [E] invalid credentials and I'm thinking of exactly the same solution. I have fail2ban set up but the lack of IP in the log is the issue.

@bobemoe commented on GitHub (May 10, 2019): This appears to be the same for a HTTP git clone or fetch. `2019/05/10 09:46:29 [...routers/repo/http.go:211 HTTP()] [E] invalid credentials` and I'm thinking of exactly the same solution. I have fail2ban set up but the lack of IP in the log is the issue.

GiteaMirror referenced this issue

2025-11-02 12:05:40 -06:00

[PR #2119] [MERGED] Fix wiki preview links #16240

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#2119