Dean Taylor

Hi Daniel,

Just to clarify I believe Lorax means the following…

I have actually experienced this before, some corporations and educational establishments do actually proxy all users through a single IP address.

This means to a website hosted outside of the internal network all users appear to be from a single IP address, the IP of the proxy.

Cheers,
Dean.

Expect to be attacked! It’s just the norm.

Here are some numbers from my simple no-name test installation with one user (me) which was installed the same time as LSS, you can see the increase in failure attempts over time:

SELECT count(*), DATE_FORMAT(date_failed, '%Y-%m') FROM wp_login_security_solution_fail GROUP BY DATE_FORMAT(date_failed, '%Y-%m')

Month	Failed Count
2012-07	109
2012-08	277
2012-09	2848
2012-10	359
2012-11	2480
2012-12	568
2013-01	502
2013-02	4134
2013-03	11340
2013-04	2979

Actually yes, there is an automatic whitelist on a per-user basis.

It was described in a previous forum post, for your reference:

The plugin has an automatic whitelist process. Whenever someone updates their password, the IP is stored for future reference. Notices may still get sent depending on the timing of attacks and legitimate logins, so users can make sure nothing bad is happening…

And checking the source code I also noted the following:

Note: saves up to 10 addresses, duplicates are not stored.

This white-listing of IP addresses occurs on a per-user basis, these are called “verified IP’s” in the code.

So you will likely see some requests for password resets if your users are coming from the same IP, but after the password is reset – that IP is whitelisted for that user. So that user will not be troubled again when logging in from that IP.

Please note this information is specific to version 0.35.0, things do change based on user feedback – but always with security in mind and after careful consideration by the plugin author.

Cheers.

Hi,

FYI: the quickest way to disable a plugin that is not behaving properly without access to the Admin Dashboard is to “rename” the plugin folder.

Described in mode detail here as “Choice 1: Disable the Files”:
http://www.ostraining.com/blog/wordpress/disable-a-wordpress-plugin/

In terms of your other questions I’ll leave those to the plugin author.

Cheers,
Dean.

Dan:

Excellent work, up-voted 🙂

Cheers,
Dean.

I agree with Dan and his statements above.

As a side note; Dan:

Could you not code around these issues by changing the code in the following form, from this:

protected function is_pw_dict_program($pw) {
		if ($this->available_dict === false) {
			return null;
		}

		$term = escapeshellarg($pw);
		exec("dict -m -s exact $term 2>&1", $output, $result);
		if (!$result) {
			return true;
		} elseif ($result == 127) {
			$this->available_dict = false;
			return null;
		}
		return false;
	}

To this:

protected function is_pw_dict_program($pw) {
		if ($this->available_dict === false) {
			return null;
		}

		$term = escapeshellarg($pw);
		// Initialise the result with an error value.
		$result = 127;
		// Suppress errors with "@"
		@exec("dict -m -s exact $term 2>&1", $output, $result);
		if (!$result) {
			return true;
		} elseif ($result == 127) {
			$this->available_dict = false;
			return null;
		}
		return false;
	}

Obviously this would need to be done in both is_pw_dictionary__grep and is_pw_dict_program.

Cheers,
Dean.