2

I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily.

E.g. for every failed login attempt, the module would add a line with remote IP addresses and time.

Is there such a module/plugin available already?

4
  • Did you try my solution ?
    – Pawan
    Jul 15, 2020 at 6:22
  • @Pawan. It does work as intended. The only thing to wish for is a bit of cleaning up the log format. Example log entry was [2020-07-16 12:35:20] failedlogin.INFO: x.x.x.x [] []. The failedlogin.INFO is probably irrelevant as it's logging to a separate file anyway. Thank you either way :) Jul 16, 2020 at 12:44
  • @DanilaVershinin, glad to know it worked. I tried to set empty name for logger but it is required filed!
    – Pawan
    Jul 16, 2020 at 13:24
  • Is it also possible to do the same with login attempts of customer login? All I found is related to the backend admin login. I also wonder why there is no simple way to include two-factor-auth for customer login. Somebody got an idea? Thanks!
    – bzybn
    Dec 17, 2020 at 10:21

1 Answer 1

2
+50

To achieve login failed in custom log file, we can create a module. In this module we need to place an observer for backend_auth_user_login_failed dispatched at vendor/magento/module-backend/Model/Auth.php.

Let's Create a module.

app/code/Pawan/FailedLogin/registration.php

<?php
\Magento\Framework\Component\ComponentRegistrar::register(
    \Magento\Framework\Component\ComponentRegistrar::MODULE,
    'Pawan_FailedLogin',
    __DIR__
); 

app/code/Pawan/FailedLogin/etc/module.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="Pawan_FailedLogin" setup_version="1.0.0"></module>
</config>

app/code/Pawan/FailedLogin/etc/adminhtml/events.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd">
    <event name="backend_auth_user_login_failed">
        <observer name="admin_login_failed" instance="Pawan\FailedLogin\Observer\FailedLogin" />
    </event>
</config>

app/code/Pawan/FailedLogin/etc/di.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <!-- Logger and Handler -->
    <type name="Pawan\FailedLogin\Logger\Handler">
        <arguments>
            <argument name="filesystem" xsi:type="object">Magento\Framework\Filesystem\Driver\File</argument>
        </arguments>
    </type>
    <type name="Pawan\FailedLogin\Logger\Logger">
        <arguments>
            <argument name="name" xsi:type="string">failedlogin</argument>
            <argument name="handlers"  xsi:type="array">
                <item name="system" xsi:type="object">Pawan\FailedLogin\Logger\Handler</item>
            </argument>
        </arguments>
    </type>
    <type name="Pawan\FailedLogin\Observer\FailedLogin">
        <arguments>
            <argument name="logger" xsi:type="object">Pawan\FailedLogin\Logger\Logger</argument>
        </arguments>
    </type>
</config>

app/code/Pawan/FailedLogin/Logger/Handler.php

<?php

namespace Pawan\FailedLogin\Logger;

use \Monolog\Logger;
use \Magento\Framework\Logger\Handler\Base;

class Handler extends Base
{
    /**
     * Logging Level
     * @var int
     */
    public $loggerType = Logger::INFO;

    /**
     * File Name
     * @var string
     */
    public $fileName = '/var/log/failedlogin.log';
}

app/code/Pawan/FailedLogin/Logger/Logger.php

<?php
namespace Pawan\FailedLogin\Logger;

class Logger extends \Monolog\Logger
{

}

app/code/Pawan/FailedLogin/Observer/FailedLogin.php

<?php

namespace Pawan\FailedLogin\Observer;

use Magento\Framework\Event\ObserverInterface;
use Pawan\FailedLogin\Logger\Logger;
use Magento\Framework\HTTP\PhpEnvironment\RemoteAddress;

class FailedLogin implements ObserverInterface
{
    private $logger;
    private $remoteAddress;

    public function __construct(
        Logger $logger,
        RemoteAddress $remoteAddress
    ) {
        $this->logger = $logger;
        $this->remoteAddress = $remoteAddress;
    }
    
    
    public function execute(\Magento\Framework\Event\Observer $observer)
    {
        $ip = $this->remoteAddress->getRemoteAddress();
        $this->logger->info($ip);
    }
}

Above code will log failed attempt in failedlogin.log file at var/log.

Whole code can be downloaded from : https://github.com/pawankparmar/failedlogin

Module can be install by composer : composer require pawan/failedlogin

3
  • @KirtiNariya, I will attempt
    – Pawan
    Jul 13, 2020 at 14:09
  • Ok @Pawan Thank you. Jul 13, 2020 at 14:12
  • Have you get any solution ? Jul 14, 2020 at 5:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.