Login and Authentication Security

Brute Force Password Attack

In order to prevent brute force password guessing, we have implemented a standard protection configuration of login attempts and lockout periods.

If a user exceeds the maximum number of login attempts on a specific account, the account will be locked for a specified period of time. This feature is disabled by default, but can be enabled and configured in the custom-values.yaml file.

user-mgmt-service:
  config:
    LoginMaxAttempts: 5
    LoginLockWindowMin: 15

yaml

LoginMaxAttempts: The maximum number of login attempts allowed before the account is locked.
LoginLockWindowMin: The duration (in minutes) for which the account is locked after exceeding the maximum number of login attempts.

If LoginMaxAttempts is set to 0 or below, the feature will be disabled.
This lockout is per user account. For example, if the maximum login attempts are exceeded for user1, only the user1 account will be locked.

Redis Storage for Session Cookies

In order to prevent cookie hijacking, we implemented a configuration to allow oauth2-proxy to use a Redis cache for session cookie validation. If this feature is enabled, a validated user’s cookie is only valid while they are logged in. Once logged out, the cookie is no longer valid. This will prevent hijackers from reusing a once-validated cookie.

This feature is disabled by default, but can be enabled and configured in the custom-values.yaml file.

To use the default setup, add the following to custom-values.yaml:

kfuse-auth:
  oauth2-proxy:
    redisSessionStorage:
      enabled: true

yaml

If you want more customization, you can set additional settings.

We only support session type redis.
Kloudfuse’s Redis is a multi-node deployment, so we encourage using the default sentinel setup provided below.

kfuse-auth:
  oauth2-proxy:
    redisSessionStorage:
      enabled: true
      sentinelEnabled: true
      redisName: "mymaster"
      redisConnectionUrl: "redis://kfuse-redis:26379"

yaml

For more information on the configuration options, see the oauth2-proxy documentation.