mirror of
https://github.com/grafana/grafana.git
synced 2025-02-15 01:53:33 -06:00
3d1c624c12
* db: add login attempt migrations * db: add possibility to create login attempts * db: add possibility to retrieve login attempt count per username * auth: validation and update of login attempts for invalid credentials If login attempt count for user authenticating is 5 or more the last 5 minutes we temporarily block the user access to login * db: add possibility to delete expired login attempts * cleanup: Delete login attempts older than 10 minutes The cleanup job are running continuously and triggering each 10 minute * fix typo: rename consequent to consequent * auth: enable login attempt validation for ldap logins * auth: disable login attempts validation by configuration Setting is named DisableLoginAttemptsValidation and is false by default Config disable_login_attempts_validation is placed under security section #7616 * auth: don't run cleanup of login attempts if feature is disabled #7616 * auth: rename settings.go to ldap_settings.go * auth: refactor AuthenticateUser Extract grafana login, ldap login and login attemp validation together with their tests to separate files. Enables testing of many more aspects when authenticating a user. #7616 * auth: rename login attempt validation to brute force login protection Setting DisableLoginAttemptsValidation => DisableBruteForceLoginProtection Configuration disable_login_attempts_validation => disable_brute_force_login_protection #7616
107 lines
2.5 KiB
Go
107 lines
2.5 KiB
Go
package cleanup
|
|
|
|
import (
|
|
"context"
|
|
"io/ioutil"
|
|
"os"
|
|
"path"
|
|
"time"
|
|
|
|
"golang.org/x/sync/errgroup"
|
|
|
|
"github.com/grafana/grafana/pkg/bus"
|
|
"github.com/grafana/grafana/pkg/log"
|
|
m "github.com/grafana/grafana/pkg/models"
|
|
"github.com/grafana/grafana/pkg/setting"
|
|
)
|
|
|
|
type CleanUpService struct {
|
|
log log.Logger
|
|
}
|
|
|
|
func NewCleanUpService() *CleanUpService {
|
|
return &CleanUpService{
|
|
log: log.New("cleanup"),
|
|
}
|
|
}
|
|
|
|
func (service *CleanUpService) Run(ctx context.Context) error {
|
|
service.log.Info("Initializing CleanUpService")
|
|
|
|
g, _ := errgroup.WithContext(ctx)
|
|
g.Go(func() error { return service.start(ctx) })
|
|
|
|
err := g.Wait()
|
|
service.log.Info("Stopped CleanUpService", "reason", err)
|
|
return err
|
|
}
|
|
|
|
func (service *CleanUpService) start(ctx context.Context) error {
|
|
service.cleanUpTmpFiles()
|
|
|
|
ticker := time.NewTicker(time.Minute * 10)
|
|
for {
|
|
select {
|
|
case <-ticker.C:
|
|
service.cleanUpTmpFiles()
|
|
service.deleteExpiredSnapshots()
|
|
service.deleteExpiredDashboardVersions()
|
|
service.deleteOldLoginAttempts()
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
}
|
|
}
|
|
}
|
|
|
|
func (service *CleanUpService) cleanUpTmpFiles() {
|
|
if _, err := os.Stat(setting.ImagesDir); os.IsNotExist(err) {
|
|
return
|
|
}
|
|
|
|
files, err := ioutil.ReadDir(setting.ImagesDir)
|
|
if err != nil {
|
|
service.log.Error("Problem reading image dir", "error", err)
|
|
return
|
|
}
|
|
|
|
var toDelete []os.FileInfo
|
|
for _, file := range files {
|
|
if file.ModTime().AddDate(0, 0, 1).Before(time.Now()) {
|
|
toDelete = append(toDelete, file)
|
|
}
|
|
}
|
|
|
|
for _, file := range toDelete {
|
|
fullPath := path.Join(setting.ImagesDir, file.Name())
|
|
err := os.Remove(fullPath)
|
|
if err != nil {
|
|
service.log.Error("Failed to delete temp file", "file", file.Name(), "error", err)
|
|
}
|
|
}
|
|
|
|
service.log.Debug("Found old rendered image to delete", "deleted", len(toDelete), "keept", len(files))
|
|
}
|
|
|
|
func (service *CleanUpService) deleteExpiredSnapshots() {
|
|
bus.Dispatch(&m.DeleteExpiredSnapshotsCommand{})
|
|
}
|
|
|
|
func (service *CleanUpService) deleteExpiredDashboardVersions() {
|
|
bus.Dispatch(&m.DeleteExpiredVersionsCommand{})
|
|
}
|
|
|
|
func (service *CleanUpService) deleteOldLoginAttempts() {
|
|
if setting.DisableBruteForceLoginProtection {
|
|
return
|
|
}
|
|
|
|
cmd := m.DeleteOldLoginAttemptsCommand{
|
|
OlderThan: time.Now().Add(time.Minute * -10),
|
|
}
|
|
if err := bus.Dispatch(&cmd); err != nil {
|
|
service.log.Error("Problem deleting expired login attempts", "error", err.Error())
|
|
} else {
|
|
service.log.Debug("Deleted expired login attempts", "rows affected", cmd.DeletedRows)
|
|
}
|
|
}
|