Files
felhom.eu/documentation/audits/lockouts-2026-10-01/B/B1-three-apps-live-templates.txt
T

125 lines
8.3 KiB
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
09:03:07 ##### bookstack — controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
11:03:07 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']
11:03:07 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
11:04:07 [1] deployed, controller state=running, pinned={'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'}
09:04:07 deploy: True
09:04:16 generated password length: 30
09:04:16 positive control — right password: ok
09:04:17 stranger wrong try 1: wrong
09:04:17 stranger wrong try 2: wrong
09:04:18 stranger wrong try 3: wrong
09:04:18 stranger wrong try 4: wrong
09:04:19 stranger wrong try 5: wrong
09:04:19 stranger wrong try 6: locked
09:04:19 household, RIGHT password, right after: locked
09:04:34 +0.3 min right password: locked
09:04:50 +0.5 min right password: locked
09:05:05 +0.8 min right password: locked
09:05:20 +1.0 min right password: ok
09:05:20 RESULT bookstack: the right password worked again after 1.0 min
09:05:21 a wrong one after: wrong | right again: ok
09:05:24
11:05:29 [X] stop -> 200 {'ok': True, 'message': 'Stack bookstack stop completed'}
11:06:01 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'bookstack', 'volumes_removed': ['bookstack_bookstack_config', 'bookstack_bookstack_db_data'], 'hdd_paths_removed': [], 'hdd_pa
11:06:09 [X] after remove: deployed=False leftovers='/opt/docker/stacks/bookstack'
09:06:09 removed; deployed = False
09:06:12 ##### grafana — controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
11:06:12 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['GF_SECURITY_ADMIN_PASSWORD']
11:06:12 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
11:06:53 [1] deployed, controller state=running, pinned={'grafana': 'grafana/grafana:13.2.3'}
09:06:53 deploy: True
09:07:01 generated password length: 30
09:07:01 positive control — right password: ok
09:07:01 stranger wrong try 1: wrong
09:07:01 stranger wrong try 2: wrong
09:07:01 stranger wrong try 3: wrong
09:07:01 stranger wrong try 4: wrong
09:07:01 stranger wrong try 5: wrong
09:07:01 stranger wrong try 6: wrong
09:07:01 household, RIGHT password, right after: wrong
09:07:17 +0.3 min right password: wrong
09:07:32 +0.5 min right password: wrong
09:07:47 +0.8 min right password: wrong
09:08:02 +1.0 min right password: wrong
09:08:17 +1.3 min right password: wrong
09:08:32 +1.5 min right password: wrong
09:08:47 +1.8 min right password: wrong
09:09:02 +2.0 min right password: wrong
09:09:17 +2.3 min right password: wrong
09:09:32 +2.5 min right password: wrong
09:09:47 +2.8 min right password: wrong
09:10:02 +3.0 min right password: wrong
09:10:17 +3.3 min right password: wrong
09:10:32 +3.5 min right password: wrong
09:10:47 +3.8 min right password: wrong
09:11:02 +4.0 min right password: wrong
09:11:17 +4.3 min right password: wrong
09:11:32 +4.5 min right password: wrong
09:11:47 +4.8 min right password: wrong
09:12:02 +5.0 min right password: ok
09:12:02 RESULT grafana: the right password worked again after 5.0 min
09:12:02 a wrong one after: wrong | right again: ok
09:12:02 ## grafana: the TRICKLE — 5 wrong, then one wrong try per minute for 8 minutes; the right password each minute
09:12:02 burst wrong 1: wrong
09:12:02 burst wrong 2: wrong
09:12:02 burst wrong 3: wrong
09:12:02 burst wrong 4: wrong
09:12:02 burst wrong 5: wrong
09:13:02 minute 1: stranger wrong -> wrong, household right -> wrong
09:14:02 minute 2: stranger wrong -> wrong, household right -> wrong
09:15:02 minute 3: stranger wrong -> wrong, household right -> wrong
09:16:03 minute 4: stranger wrong -> wrong, household right -> wrong
09:17:03 minute 5: stranger wrong -> wrong, household right -> ok
09:18:03 minute 6: stranger wrong -> wrong, household right -> ok
09:19:03 minute 7: stranger wrong -> wrong, household right -> ok
09:20:03 minute 8: stranger wrong -> wrong, household right -> ok
09:20:03 stop the trickle; wait for the right password:
09:20:18 +0.3 min right password: ok
09:20:18 RESULT grafana trickle: open again 0.3 min after the last wrong try
09:20:21 logger=authn.service t=2026-10-01T11:16:02.977306539+02:00 level=info msg="Failed to authenticate request" client=auth.client.form error="[password-auth.failed] too many consecutive incorrect login at
logger=context userId=0 orgId=0 uname= t=2026-10-01T11:16:02.978088015+02:00 level=info msg="Request Completed" method=POST path=/login status=401 remote_addr=192.168.0.180 time_ms=1 duration=1.228039
logger=authn.service t=2026-10-01T11:16:03.000927142+02:00 level=info msg="Failed to authenticate request" client=auth.client.form error="[password-auth.failed] too many consecutive incorrect login at
logger=context userId=0 orgId=0 uname= t=2026-10-01T11:16:03.001553164+02:00 level=info msg="Request Completed" method=POST path=/login status=401 remote_addr=192.168.0.180 time_ms=1 duration=1.066954
11:20:22 [X] stop -> 200 {'ok': True, 'message': 'Stack grafana stop completed'}
11:20:54 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'grafana', 'volumes_removed': ['grafana_grafana_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alk
11:21:02 [X] after remove: deployed=False leftovers='/opt/docker/stacks/grafana'
09:21:02 removed; deployed = False
09:21:05 ##### calibre-web — controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
11:21:08 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/calibre-web']
11:21:08 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'ADMIN_PASSWORD']
11:21:08 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
11:21:48 [1] deployed, controller state=running, pinned={'calibre-web': 'crocodilestick/calibre-web-automated:v4.0.8'}
09:21:48 deploy: True
09:21:57 generated password length: 30
09:21:57 positive control — right password: ok
09:21:57 stranger wrong try 1: wrong
09:21:57 stranger wrong try 2: wrong
09:21:58 stranger wrong try 3: wrong
09:21:58 stranger wrong try 4: locked
09:21:58 household, RIGHT password, right after: locked
09:23:08 +1.2 min right password: ok
09:23:08 RESULT calibre-web: the right password worked again after 1.2 min
09:23:08 a wrong one after: wrong | right again: ok
09:23:08 ## calibre-web: OPDS basic auth (the book-feed door) — 60 wrong tries as a stranger
09:23:13 OPDS wrong tries: {'locked': 57, 'wrong': 3}
09:23:13 OPDS right password after: locked | the login form, right password: ok
09:23:13 ## calibre-web: the DAILY limit — 40 wrong tries at the 3/minute pace (~14 min), then the right password
09:26:18 wrong try 10: wrong
09:29:23 wrong try 20: wrong
09:32:28 wrong try 30: wrong
09:36:34 wrong try 40: wrong
09:37:36 household, RIGHT password after 40: locked
09:39:46 household, RIGHT password 2 min later (past the minute window): locked
09:39:54 restart the app (the limiter's store is in memory): restarted
09:39:59 household, RIGHT password after the restart: ok
09:40:02 [2026-10-01 11:39:46,068] INFO {flask-limiter:1102} ratelimit 40 per 1 day (admin) exceeded at endpoint: web.login_post
[cwa-init] Checking for leftover lock files from previous instance...
[cwa-init] No leftover lock files to remove. Ending service...
[2026-10-01 11:39:56,532] WARN {py.warnings:110} /lsiopy/lib/python3.13/site-packages/flask_limiter/extension.py:324: UserWarning: Using the in-memory storage for tracking rate limits as no storage w
11:40:13 [X] stop -> 200 {'ok': True, 'message': 'Stack calibre-web stop completed'}
11:40:18 [X] remove (with drive data) -> 409 {'ok': False, 'error': 'A(z) /mnt/felhom-drives/scratch_hdd/userdata/calibre-web tárhely jelenleg nem elérhető — az alkalmazás nem távolítható el, amíg a meghaj
11:40:18 [X] refused because the drive path cannot be resolved (R-442, fail-closed and right) — removing the app and KEEPING the drive data instead
11:40:45 [X] remove (keeping drive data) -> 200 {'ok': True, 'data': {'removed': 'calibre-web', 'volumes_removed': ['calibre-web_calibre_web_config'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'back
11:40:53 [X] after remove: deployed=False leftovers='/opt/docker/stacks/calibre-web'
09:40:53 removed; deployed = False