Magento 2 module to log failed login attempts, for Fail2ban

Question

I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily.

E.g. for every failed login attempt, the module would add a line with remote IP addresses and time.

Is there such a module/plugin available already?

Answer 1

To achieve login failed in custom log file, we can create a module. In this module we need to place an observer for backend_auth_user_login_failed dispatched at vendor/magento/module-backend/Model/Auth.php.

Let's Create a module.

app/code/Pawan/FailedLogin/registration.php

<?php
\Magento\Framework\Component\ComponentRegistrar::register(
    \Magento\Framework\Component\ComponentRegistrar::MODULE,
    'Pawan_FailedLogin',
    __DIR__
); 

app/code/Pawan/FailedLogin/etc/module.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="Pawan_FailedLogin" setup_version="1.0.0"></module>
</config>

app/code/Pawan/FailedLogin/etc/adminhtml/events.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd">
    <event name="backend_auth_user_login_failed">
        <observer name="admin_login_failed" instance="Pawan\FailedLogin\Observer\FailedLogin" />
    </event>
</config>

app/code/Pawan/FailedLogin/etc/di.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <!-- Logger and Handler -->
    <type name="Pawan\FailedLogin\Logger\Handler">
        <arguments>
            <argument name="filesystem" xsi:type="object">Magento\Framework\Filesystem\Driver\File</argument>
        </arguments>
    </type>
    <type name="Pawan\FailedLogin\Logger\Logger">
        <arguments>
            <argument name="name" xsi:type="string">failedlogin</argument>
            <argument name="handlers"  xsi:type="array">
                <item name="system" xsi:type="object">Pawan\FailedLogin\Logger\Handler</item>
            </argument>
        </arguments>
    </type>
    <type name="Pawan\FailedLogin\Observer\FailedLogin">
        <arguments>
            <argument name="logger" xsi:type="object">Pawan\FailedLogin\Logger\Logger</argument>
        </arguments>
    </type>
</config>

app/code/Pawan/FailedLogin/Logger/Handler.php

<?php

namespace Pawan\FailedLogin\Logger;

use \Monolog\Logger;
use \Magento\Framework\Logger\Handler\Base;

class Handler extends Base
{
    /**
     * Logging Level
     * @var int
     */
    public $loggerType = Logger::INFO;

    /**
     * File Name
     * @var string
     */
    public $fileName = '/var/log/failedlogin.log';
}

app/code/Pawan/FailedLogin/Logger/Logger.php

<?php
namespace Pawan\FailedLogin\Logger;

class Logger extends \Monolog\Logger
{

}

app/code/Pawan/FailedLogin/Observer/FailedLogin.php

<?php

namespace Pawan\FailedLogin\Observer;

use Magento\Framework\Event\ObserverInterface;
use Pawan\FailedLogin\Logger\Logger;
use Magento\Framework\HTTP\PhpEnvironment\RemoteAddress;

class FailedLogin implements ObserverInterface
{
    private $logger;
    private $remoteAddress;

    public function __construct(
        Logger $logger,
        RemoteAddress $remoteAddress
    ) {
        $this->logger = $logger;
        $this->remoteAddress = $remoteAddress;
    }
    
    
    public function execute(\Magento\Framework\Event\Observer $observer)
    {
        $ip = $this->remoteAddress->getRemoteAddress();
        $this->logger->info($ip);
    }
}

Above code will log failed attempt in failedlogin.log file at var/log.

Whole code can be downloaded from : https://github.com/pawankparmar/failedlogin

Module can be install by composer : composer require pawan/failedlogin