Re: [mosquitto-dev] Query : Mechanism to drop or block too many unauthor

[Greg Troxel <gdt@xxxxxxxxxx>]

[quoting cleaned up with no intended actul change]

Roger Light via mosquitto-dev <mosquitto-dev@xxxxxxxxxxx> writes:

> On Thu, 22 Jun 2023 at 14:20, Pratik Raj <rajpratik71@xxxxxxxxx> wrote:
>
>> Is it possible to block or limit the no. of unauthorized for a username or
>> clientId by a flag/config ?

> Not at the moment. What sort of procedure did you have in mind?

I'm not Pratik, but there are a few things out there that attempt to
scoreboard failed attempts and block IP addresses for a while.

Generally, blocking repeat attempts of a username is not such a great
idea as it becomes trivial to DOS the system.

Example packages are:

  fail2ban: this is probably the ur-typ of such schemes.  It leans to
  firewall, but could perhaps inject rules to someplace else
    https://www.fail2ban.org/wiki/index.php/Main_Page

  blocklistd: this is similar, and native on NetBSD.  It has been ported
  to FreeBSD.  It seems more or less equivalent.
    https://man.netbsd.org/blocklistd.


Ideally, there'd be a daemon like one of these that could also be
queried, so one could just reject auth attempts, vs firewalling.
However, Pratik might want to hook in fail2ban firewall.

Pratik: Having read this, I wonder what you now think you would like to
do?