Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature Request]: Log more information in traces #2563

Open
sdwilsh opened this issue Jan 28, 2025 · 2 comments
Open

[Feature Request]: Log more information in traces #2563

sdwilsh opened this issue Jan 28, 2025 · 2 comments

Comments

@sdwilsh
Copy link

sdwilsh commented Jan 28, 2025

I'd love to see some additional logging, at least for a few end points, so it's easier to understand if someone is trying to brute-force a login or generally abuse the system.

Proposal

I would like to see the following additions to the instrumentation that currently exists:

  • client ip address
  • http status, at least on error

I would like to see this done at least for the following routes:

  • /account
  • /account/password
  • /api/v0/account/verify
  • /api/v0/account/send-verification
  • /login
  • /register

Goal

I'd like to write a crowdsec parser and scenarios to detect brute force and denial of service behaviors so I can feel more comfortable about my self-hosted atuin server that I've exposed to the public.

I'm willing to do the work for this, but I wanted to make sure it's something that'd be accepted before I put more work into it.

@sdwilsh
Copy link
Author

sdwilsh commented Jan 28, 2025

I've put up #2564 to showcase what I have in mind. It covers the /login route.

@ellie
Copy link
Member

ellie commented Mar 3, 2025

I'm super happy for this to be included! And like the look of your draft. Thank you for the suggestion

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants