feat/login-security #1824

Closed

bookenjoyer67 wants to merge 2 commits from bookenjoyer67/continuwuity:feat/login-security into main

bookenjoyer67 commented

2026-05-28 19:45:05 +00:00

First-time contributor

Adds a login_security service providing brute-force protection for Matrix
homeservers. Helps operators defend against credential-stuffing and
password-spraying attacks.

What it does

Tracks failed login attempts per user and per IP address
Automatically locks accounts and blocks IPs when thresholds are exceeded
Supports graduated lock durations (escalating for repeat offenders)
Configurable attempt windows, thresholds, and lock TTLs
Admin room commands for inspecting and managing blocks/locks
Optional audit logging of all login attempts

Configuration

New [global.login_security] section in conduwuit.toml:

max_failed_attempts_per_user (default: 5)
max_failed_attempts_per_ip (default: 10)
lock_duration_seconds (default: 300)
attempt_window_seconds (default: 900)
enable_ip_rate_limiting / enable_user_rate_limiting (default: true)
log_all_attempts (default: true)
graduated_lock_durations (default: [300, 900, 3600])
All defaults are conservative and can be tightened or disabled per
operator preference.

Testing

Deployed and running on a live federated homeserver
Verified against repeated login failures from same user / same IP
Admin commands tested in management room

Adds a login_security service providing brute-force protection for Matrix homeservers. Helps operators defend against credential-stuffing and password-spraying attacks. ### What it does - Tracks failed login attempts per user and per IP address - Automatically locks accounts and blocks IPs when thresholds are exceeded - Supports graduated lock durations (escalating for repeat offenders) - Configurable attempt windows, thresholds, and lock TTLs - Admin room commands for inspecting and managing blocks/locks - Optional audit logging of all login attempts ### Configuration New `[global.login_security]` section in `conduwuit.toml`: - `max_failed_attempts_per_user` (default: 5) - `max_failed_attempts_per_ip` (default: 10) - `lock_duration_seconds` (default: 300) - `attempt_window_seconds` (default: 900) - `enable_ip_rate_limiting` / `enable_user_rate_limiting` (default: true) - `log_all_attempts` (default: true) - `graduated_lock_durations` (default: [300, 900, 3600]) All defaults are conservative and can be tightened or disabled per operator preference. ### Testing - Deployed and running on a live federated homeserver - Verified against repeated login failures from same user / same IP - Admin commands tested in management room

bookenjoyer67 added 2 commits

2026-05-28 19:45:05 +00:00

feat: add login security module with rate limiting and account locking f1175dac4a

feat: add login security configuration with graduated lock durations

Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 2s

Details

Documentation / Build and Deploy Documentation (pull_request) Has been cancelled

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled

Details

Checks / Prek / Check changed files (pull_request) Has been cancelled

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled

Details

Checks / Changelog / Check changelog is added (pull_request_target) Failing after 9s

Details

08c17cada6

forgejo-actions added the

Changelog

Missing

label

2026-05-28 19:45:12 +00:00

nex closed this pull request

2026-05-28 19:58:29 +00:00

Jade commented

2026-05-28 19:59:54 +00:00

Owner

Please discuss large changes in the development discussion room, and follow the pull request template.

Please discuss large changes in [the development discussion room](https://matrix.to/#/!ksTlboXVgcyWjv5GrlEeKyQuJ8ZCprnwQx2b6-BQ44Q?via=continuwuity.org&via=matrix.org&via=federated.nexus), and follow the pull request template.