2

I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily.

E.g. for every failed login attempt, the module would add a line with remote IP addresses and time.

Is there such a module/plugin available already?

4
  • Did you try my solution ? – Pawan Jul 15 '20 at 6:22
  • @Pawan. It does work as intended. The only thing to wish for is a bit of cleaning up the log format. Example log entry was [2020-07-16 12:35:20] failedlogin.INFO: x.x.x.x [] []. The failedlogin.INFO is probably irrelevant as it's logging to a separate file anyway. Thank you either way :) – Danila Vershinin Jul 16 '20 at 12:44
  • @DanilaVershinin, glad to know it worked. I tried to set empty name for logger but it is required filed! – Pawan Jul 16 '20 at 13:24
  • Is it also possible to do the same with login attempts of customer login? All I found is related to the backend admin login. I also wonder why there is no simple way to include two-factor-auth for customer login. Somebody got an idea? Thanks! – bzybn Dec 17 '20 at 10:21
1
+50

To achieve login failed in custom log file, we can create a module. In this module we need to place an observer for backend_auth_user_login_failed dispatched at vendor/magento/module-backend/Model/Auth.php.

Let's Create a module.

app/code/Pawan/FailedLogin/registration.php

<?php
\Magento\Framework\Component\ComponentRegistrar::register(
    \Magento\Framework\Component\ComponentRegistrar::MODULE,
    'Pawan_FailedLogin',
    __DIR__
); 

app/code/Pawan/FailedLogin/etc/module.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="Pawan_FailedLogin" setup_version="1.0.0"></module>
</config>

app/code/Pawan/FailedLogin/etc/adminhtml/events.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd">
    <event name="backend_auth_user_login_failed">
        <observer name="admin_login_failed" instance="Pawan\FailedLogin\Observer\FailedLogin" />
    </event>
</config>

app/code/Pawan/FailedLogin/etc/di.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <!-- Logger and Handler -->
    <type name="Pawan\FailedLogin\Logger\Handler">
        <arguments>
            <argument name="filesystem" xsi:type="object">Magento\Framework\Filesystem\Driver\File</argument>
        </arguments>
    </type>
    <type name="Pawan\FailedLogin\Logger\Logger">
        <arguments>
            <argument name="name" xsi:type="string">failedlogin</argument>
            <argument name="handlers"  xsi:type="array">
                <item name="system" xsi:type="object">Pawan\FailedLogin\Logger\Handler</item>
            </argument>
        </arguments>
    </type>
    <type name="Pawan\FailedLogin\Observer\FailedLogin">
        <arguments>
            <argument name="logger" xsi:type="object">Pawan\FailedLogin\Logger\Logger</argument>
        </arguments>
    </type>
</config>

app/code/Pawan/FailedLogin/Logger/Handler.php

<?php

namespace Pawan\FailedLogin\Logger;

use \Monolog\Logger;
use \Magento\Framework\Logger\Handler\Base;

class Handler extends Base
{
    /**
     * Logging Level
     * @var int
     */
    public $loggerType = Logger::INFO;

    /**
     * File Name
     * @var string
     */
    public $fileName = '/var/log/failedlogin.log';
}

app/code/Pawan/FailedLogin/Logger/Logger.php

<?php
namespace Pawan\FailedLogin\Logger;

class Logger extends \Monolog\Logger
{

}

app/code/Pawan/FailedLogin/Observer/FailedLogin.php

<?php

namespace Pawan\FailedLogin\Observer;

use Magento\Framework\Event\ObserverInterface;
use Pawan\FailedLogin\Logger\Logger;
use Magento\Framework\HTTP\PhpEnvironment\RemoteAddress;

class FailedLogin implements ObserverInterface
{
    private $logger;
    private $remoteAddress;

    public function __construct(
        Logger $logger,
        RemoteAddress $remoteAddress
    ) {
        $this->logger = $logger;
        $this->remoteAddress = $remoteAddress;
    }
    
    
    public function execute(\Magento\Framework\Event\Observer $observer)
    {
        $ip = $this->remoteAddress->getRemoteAddress();
        $this->logger->info($ip);
    }
}

Above code will log failed attempt in failedlogin.log file at var/log.

Whole code can be downloaded from : https://github.com/pawankparmar/failedlogin

Module can be install by composer : composer require pawan/failedlogin

3
  • @KirtiNariya, I will attempt – Pawan Jul 13 '20 at 14:09
  • Ok @Pawan Thank you. – Kirti Nariya Jul 13 '20 at 14:12
  • Have you get any solution ? – Kirti Nariya Jul 14 '20 at 5:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.