Log failed WebGUI-login attempts

[olegbliaher]

That would be really nice. That way we can block any bruteforce attempts with fail2ban aswell.

I noticed it can be easily achieved by modifying app/controllers/sessions_controller.rb:

  rescue Postal::Errors::AuthenticationError
    Postal.logger.error "Invalid credentials for #{request.remote_ip}", component: "postal-web" # the new line
    flash.now[:alert] = "The credentials you've provided are incorrect. Please check and try again."
    render "new"
  end

[willpower232]

I don't hate the idea, I'm not sure if the rails logs actually make their way out. Do you see that new line in postal logs web?

[olegbliaher]

Absolutely, this is live on a few servers I'm using:

web-1 | 2024-11-04 13:53:44 +0000 ERROR Invalid credentials for [IPADDR] component=postal-web

And what's even better, fail2ban sees it :)

[willpower232]

Oh excellent, would you like to make a PR of your code change?

[olegbliaher]

Done! :)