- Information Leak Defense
- Brute Attack Defense
- Problem : Attacker can guess the password endlessly until cracks it
- Solution : Block user after 5 failed login attempts
- Clone this project
- Re-build the project
$ mvn clean install -DskipTests=true
- Install wireshark and start wireshark
# Install wireshark $ sudo apt install wireshark # Start wireshark $ sudo wireshark
-
Create a folder to place generated certicates and enter the folder
$ mkdir ~/.SSLCA $ cd ~/.SSLCA
-
Generate a self-signed certificate for in-cse
- Set password to '000000'
$ keytool -genkey -dname "CN=127.0.0.1" -alias INCSE -keystore .keystore_incse -keyalg RSA -keysize 1024
-
Generate a self-signed certificate for mn-cse
- Set password to '000000'
$ keytool -genkey -dname "CN=127.0.0.1" -alias MNCSE -keystore .keystore_mncse -keyalg RSA -keysize 1024
-
Append the following code to the bottom of "config.ini" of in-cse
- Enable HTTPS
- Set HTTPS port to 8443
- certificate password : 000000
- Set the path of certificate : /home/[user_name]/.SSLCA/.keystore_incse
- Use TLS protocal
org.eclipse.equinox.http.jetty.https.enabled=true org.eclipse.equinox.http.jetty.https.port=8443 org.eclipse.equinox.http.jetty.ssl.password=000000 org.eclipse.equinox.http.jetty.ssl.keypassword=000000 org.eclipse.equinox.http.jetty.ssl.keystore=/home/om2m/.SSLCA/.keystore_incse org.eclipse.equinox.http.jetty.ssl.protocol=TLS
-
Append the following code to the bottom of "config.ini" of mn-cse
- Enable HTTPS
- Set HTTPS port to 8444
- certificate password : 000000
- Set the path of certificate : /home/[user_name]/.SSLCA/.keystore_mncse
- Use TLS protocal
org.eclipse.equinox.http.jetty.https.enabled=true org.eclipse.equinox.http.jetty.https.port=8444 org.eclipse.equinox.http.jetty.ssl.password=000000 org.eclipse.equinox.http.jetty.ssl.keypassword=000000 org.eclipse.equinox.http.jetty.ssl.keystore=/home/om2m/.SSLCA/.keystore_mncse org.eclipse.equinox.http.jetty.ssl.protocol=TLS
-
Start in-cse and mn-cse
$ sh start.sh
-
Open browser and enter 'https://127.0.0.1:8443/webpage' for in-cse
-
Open browser and enter 'https://127.0.0.1:8444/webpage' for mn-cse
-
Use wireshark to check whether the packet is encrypted after enabling https
Work at org.eclipse.om2m/org.eclipse.om2m.webapp.resourcesbrowser.json/
graph LR
A[func login] -->B[func get]
B -->|success| C(enter cse)
B -->|error| D(print error mesage)
-
Declare 3 additional variables and const
- const tryCountMax : Maximum number of failed login attempts allowed for a user
- var tryCount : Cumulative number of failed attempts
- var isBlocked : If true, the user is banned
-
Modify
func login
- This function is triggered when user try to login
- It collects the username:password pair and calls "func get" to determine if the pair is legal
- I use isBlocked to determine if the user has permission to log in
- This function is triggered when user try to login
-
Modify
func get
Successfully ban the user with more than 5 failed login attempts