mirror of https://github.com/jumpserver/jumpserver
perf: 优化ip黑白名单
feng626
Jiangjie.Bai
parent
bd92045b50
commit
3052c4cc19
|
|
@ -8,7 +8,7 @@ from common.utils.ip import is_ip_address, is_ip_network, is_ip_segment
|
|||
|
||||
logger = get_logger(__file__)
|
||||
|
||||
__all__ = ['RuleSerializer']
|
||||
__all__ = ['RuleSerializer', 'ip_group_child_validator', 'ip_group_help_text']
|
||||
|
||||
|
||||
def ip_group_child_validator(ip_group_child):
|
||||
|
|
@ -21,13 +21,14 @@ def ip_group_child_validator(ip_group_child):
|
|||
raise serializers.ValidationError(error)
|
||||
|
||||
|
||||
class RuleSerializer(serializers.Serializer):
|
||||
ip_group_help_text = _(
|
||||
'Format for comma-delimited string, with * indicating a match all. '
|
||||
'Such as: '
|
||||
'192.168.10.1, 192.168.1.0/24, 10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:db8:1a:1110::/64 '
|
||||
)
|
||||
ip_group_help_text = _(
|
||||
'Format for comma-delimited string, with * indicating a match all. '
|
||||
'Such as: '
|
||||
'192.168.10.1, 192.168.1.0/24, 10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:db8:1a:1110::/64 '
|
||||
)
|
||||
|
||||
|
||||
class RuleSerializer(serializers.Serializer):
|
||||
ip_group = serializers.ListField(
|
||||
default=['*'], label=_('IP'), help_text=ip_group_help_text,
|
||||
child=serializers.CharField(max_length=1024, validators=[ip_group_child_validator]))
|
||||
|
|
|
|||
|
|
@ -51,10 +51,14 @@ invalid_login_msg = _(
|
|||
"You can also try {times_try} times "
|
||||
"(The account will be temporarily locked for {block_time} minutes)"
|
||||
)
|
||||
block_login_msg = _(
|
||||
block_user_login_msg = _(
|
||||
"The account has been locked "
|
||||
"(please contact admin to unlock it or try again after {} minutes)"
|
||||
)
|
||||
block_ip_login_msg = _(
|
||||
"The ip has been locked "
|
||||
"(please contact admin to unlock it or try again after {} minutes)"
|
||||
)
|
||||
block_mfa_msg = _(
|
||||
"The account has been locked "
|
||||
"(please contact admin to unlock it or try again after {} minutes)"
|
||||
|
|
@ -118,7 +122,7 @@ class BlockGlobalIpLoginError(AuthFailedError):
|
|||
error = 'block_global_ip_login'
|
||||
|
||||
def __init__(self, username, ip, **kwargs):
|
||||
self.msg = _("IP is not allowed")
|
||||
self.msg = block_ip_login_msg.format(settings.SECURITY_LOGIN_IP_LIMIT_TIME)
|
||||
LoginIpBlockUtil(ip).set_block_if_need()
|
||||
super().__init__(username=username, ip=ip, **kwargs)
|
||||
|
||||
|
|
@ -133,7 +137,7 @@ class CredentialError(
|
|||
block_time = settings.SECURITY_LOGIN_LIMIT_TIME
|
||||
|
||||
if times_remainder < 1:
|
||||
self.msg = block_login_msg.format(settings.SECURITY_LOGIN_LIMIT_TIME)
|
||||
self.msg = block_user_login_msg.format(settings.SECURITY_LOGIN_LIMIT_TIME)
|
||||
return
|
||||
|
||||
default_msg = invalid_login_msg.format(
|
||||
|
|
@ -184,7 +188,7 @@ class BlockLoginError(AuthFailedNeedBlockMixin, AuthFailedError):
|
|||
error = 'block_login'
|
||||
|
||||
def __init__(self, username, ip):
|
||||
self.msg = block_login_msg.format(settings.SECURITY_LOGIN_LIMIT_TIME)
|
||||
self.msg = block_user_login_msg.format(settings.SECURITY_LOGIN_LIMIT_TIME)
|
||||
super().__init__(username=username, ip=ip)
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -291,9 +291,6 @@ class Config(dict):
|
|||
'SECURITY_COMMAND_EXECUTION': True,
|
||||
'SECURITY_SERVICE_ACCOUNT_REGISTRATION': True,
|
||||
'SECURITY_VIEW_AUTH_NEED_MFA': True,
|
||||
'SECURITY_LOGIN_LIMIT_COUNT': 7,
|
||||
'SECURITY_LOGIN_IP_BLACK_LIST': [],
|
||||
'SECURITY_LOGIN_LIMIT_TIME': 30,
|
||||
'SECURITY_MAX_IDLE_TIME': 30,
|
||||
'SECURITY_PASSWORD_EXPIRATION_TIME': 9999,
|
||||
'SECURITY_PASSWORD_MIN_LENGTH': 6,
|
||||
|
|
@ -318,6 +315,14 @@ class Config(dict):
|
|||
'USER_LOGIN_SINGLE_MACHINE_ENABLED': False,
|
||||
'ONLY_ALLOW_EXIST_USER_AUTH': False,
|
||||
'ONLY_ALLOW_AUTH_FROM_SOURCE': False,
|
||||
# 用户登录限制的规则
|
||||
'SECURITY_LOGIN_LIMIT_COUNT': 7,
|
||||
'SECURITY_LOGIN_LIMIT_TIME': 30,
|
||||
# 登录IP限制的规则
|
||||
'SECURITY_LOGIN_IP_BLACK_LIST': [],
|
||||
'SECURITY_LOGIN_IP_WHITE_LIST': [],
|
||||
'SECURITY_LOGIN_IP_LIMIT_COUNT': 99999,
|
||||
'SECURITY_LOGIN_IP_LIMIT_TIME': 30,
|
||||
|
||||
# 启动前
|
||||
'HTTP_BIND_HOST': '0.0.0.0',
|
||||
|
|
|
|||
|
|
@ -32,11 +32,8 @@ TERMINAL_REPLAY_STORAGE = CONFIG.TERMINAL_REPLAY_STORAGE
|
|||
|
||||
# Security settings
|
||||
SECURITY_MFA_AUTH = CONFIG.SECURITY_MFA_AUTH
|
||||
SECURITY_COMMAND_EXECUTION = CONFIG.SECURITY_COMMAND_EXECUTION
|
||||
SECURITY_LOGIN_LIMIT_COUNT = CONFIG.SECURITY_LOGIN_LIMIT_COUNT
|
||||
SECURITY_LOGIN_IP_BLACK_LIST = CONFIG.SECURITY_LOGIN_IP_BLACK_LIST
|
||||
SECURITY_LOGIN_LIMIT_TIME = CONFIG.SECURITY_LOGIN_LIMIT_TIME # Unit: minute
|
||||
SECURITY_MAX_IDLE_TIME = CONFIG.SECURITY_MAX_IDLE_TIME # Unit: minute
|
||||
SECURITY_COMMAND_EXECUTION = CONFIG.SECURITY_COMMAND_EXECUTION
|
||||
SECURITY_PASSWORD_EXPIRATION_TIME = CONFIG.SECURITY_PASSWORD_EXPIRATION_TIME # Unit: day
|
||||
SECURITY_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_PASSWORD_MIN_LENGTH # Unit: bit
|
||||
SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH = CONFIG.SECURITY_ADMIN_USER_PASSWORD_MIN_LENGTH # Unit: bit
|
||||
|
|
@ -63,6 +60,14 @@ SECURITY_INSECURE_COMMAND = CONFIG.SECURITY_INSECURE_COMMAND
|
|||
SECURITY_INSECURE_COMMAND_LEVEL = CONFIG.SECURITY_INSECURE_COMMAND_LEVEL
|
||||
SECURITY_INSECURE_COMMAND_EMAIL_RECEIVER = CONFIG.SECURITY_INSECURE_COMMAND_EMAIL_RECEIVER
|
||||
SECURITY_CHECK_DIFFERENT_CITY_LOGIN = CONFIG.SECURITY_CHECK_DIFFERENT_CITY_LOGIN
|
||||
# 用户登录限制的规则
|
||||
SECURITY_LOGIN_LIMIT_COUNT = CONFIG.SECURITY_LOGIN_LIMIT_COUNT
|
||||
SECURITY_LOGIN_LIMIT_TIME = CONFIG.SECURITY_LOGIN_LIMIT_TIME # Unit: minute
|
||||
# 登录IP限制的规则
|
||||
SECURITY_LOGIN_IP_BLACK_LIST = CONFIG.SECURITY_LOGIN_IP_BLACK_LIST
|
||||
SECURITY_LOGIN_IP_WHITE_LIST = CONFIG.SECURITY_LOGIN_IP_WHITE_LIST
|
||||
SECURITY_LOGIN_IP_LIMIT_COUNT = CONFIG.SECURITY_LOGIN_IP_LIMIT_COUNT
|
||||
SECURITY_LOGIN_IP_LIMIT_TIME = CONFIG.SECURITY_LOGIN_IP_LIMIT_TIME # Unit: minute
|
||||
|
||||
# Terminal other setting
|
||||
TERMINAL_PASSWORD_AUTH = CONFIG.TERMINAL_PASSWORD_AUTH
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ msgid ""
|
|||
msgstr ""
|
||||
"Project-Id-Version: JumpServer 0.3.3\n"
|
||||
"Report-Msgid-Bugs-To: \n"
|
||||
"POT-Creation-Date: 2021-11-18 19:00+0800\n"
|
||||
"POT-Creation-Date: 2021-11-19 15:28+0800\n"
|
||||
"PO-Revision-Date: 2021-05-20 10:54+0800\n"
|
||||
"Last-Translator: ibuler <ibuler@qq.com>\n"
|
||||
"Language-Team: JumpServer team<ibuler@qq.com>\n"
|
||||
|
|
@ -180,7 +180,7 @@ msgstr ""
|
|||
"格式为逗号分隔的字符串, * 表示匹配所有。例如: 192.168.10.1, 192.168.1.0/24, "
|
||||
"10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:db8:1a:1110::/64 （支持网域）"
|
||||
|
||||
#: acls/serializers/login_asset_acl.py:31 acls/serializers/rules/rules.py:32
|
||||
#: acls/serializers/login_asset_acl.py:31 acls/serializers/rules/rules.py:33
|
||||
#: applications/serializers/attrs/application_type/mysql_workbench.py:18
|
||||
#: assets/models/asset.py:211 assets/models/domain.py:61
|
||||
#: assets/serializers/account.py:12
|
||||
|
|
@ -225,12 +225,12 @@ msgstr "组织 `{}` 不存在"
|
|||
msgid "None of the reviewers belong to Organization `{}`"
|
||||
msgstr "所有复核人都不属于组织 `{}`"
|
||||
|
||||
#: acls/serializers/rules/rules.py:20 settings/serializers/security.py:35
|
||||
#: acls/serializers/rules/rules.py:20
|
||||
#: xpack/plugins/cloud/serializers/task.py:23
|
||||
msgid "IP address invalid: `{}`"
|
||||
msgstr "IP 地址无效: `{}`"
|
||||
|
||||
#: acls/serializers/rules/rules.py:26
|
||||
#: acls/serializers/rules/rules.py:25
|
||||
msgid ""
|
||||
"Format for comma-delimited string, with * indicating a match all. Such as: "
|
||||
"192.168.10.1, 192.168.1.0/24, 10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:"
|
||||
|
|
@ -239,7 +239,7 @@ msgstr ""
|
|||
"格式为逗号分隔的字符串, * 表示匹配所有。例如: 192.168.10.1, 192.168.1.0/24, "
|
||||
"10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:db8:1a:1110::/64"
|
||||
|
||||
#: acls/serializers/rules/rules.py:34
|
||||
#: acls/serializers/rules/rules.py:35
|
||||
msgid "Time Period"
|
||||
msgstr "时段"
|
||||
|
||||
|
|
@ -1619,13 +1619,19 @@ msgstr ""
|
|||
"您输入的用户名或密码不正确，请重新输入。 您还可以尝试 {times_try} 次（账号将"
|
||||
"被临时 锁定 {block_time} 分钟）"
|
||||
|
||||
#: authentication/errors.py:55 authentication/errors.py:59
|
||||
#: authentication/errors.py:55 authentication/errors.py:63
|
||||
msgid ""
|
||||
"The account has been locked (please contact admin to unlock it or try again "
|
||||
"after {} minutes)"
|
||||
msgstr "账号已被锁定（请联系管理员解锁 或 {}分钟后重试）"
|
||||
msgstr "账号已被锁定（请联系管理员解锁或{}分钟后重试）"
|
||||
|
||||
#: authentication/errors.py:63
|
||||
#: authentication/errors.py:59
|
||||
msgid ""
|
||||
"The ip has been locked (please contact admin to unlock it or try again after "
|
||||
"{} minutes)"
|
||||
msgstr "IP 已被锁定（请联系管理员解锁或{}分钟后重试）"
|
||||
|
||||
#: authentication/errors.py:67
|
||||
#, python-brace-format
|
||||
msgid ""
|
||||
"{error}, You can also try {times_try} times (The account will be temporarily "
|
||||
|
|
@ -1633,63 +1639,63 @@ msgid ""
|
|||
msgstr ""
|
||||
"{error}，您还可以尝试 {times_try} 次（账号将被临时锁定 {block_time} 分钟）"
|
||||
|
||||
#: authentication/errors.py:67
|
||||
#: authentication/errors.py:71
|
||||
msgid "MFA required"
|
||||
msgstr "需要 MFA 认证"
|
||||
|
||||
#: authentication/errors.py:68
|
||||
#: authentication/errors.py:72
|
||||
msgid "MFA not set, please set it first"
|
||||
msgstr "MFA 没有设置，请先完成设置"
|
||||
|
||||
#: authentication/errors.py:69
|
||||
#: authentication/errors.py:73
|
||||
msgid "Login confirm required"
|
||||
msgstr "需要登录复核"
|
||||
|
||||
#: authentication/errors.py:70
|
||||
#: authentication/errors.py:74
|
||||
msgid "Wait login confirm ticket for accept"
|
||||
msgstr "等待登录复核处理"
|
||||
|
||||
#: authentication/errors.py:71
|
||||
#: authentication/errors.py:75
|
||||
msgid "Login confirm ticket was {}"
|
||||
msgstr "登录复核 {}"
|
||||
|
||||
#: authentication/errors.py:121 authentication/errors.py:251
|
||||
#: authentication/errors.py:255
|
||||
msgid "IP is not allowed"
|
||||
msgstr "来源 IP 不被允许登录"
|
||||
|
||||
#: authentication/errors.py:258
|
||||
#: authentication/errors.py:262
|
||||
msgid "Time Period is not allowed"
|
||||
msgstr "该 时间段 不被允许登录"
|
||||
|
||||
#: authentication/errors.py:291
|
||||
#: authentication/errors.py:295
|
||||
msgid "SSO auth closed"
|
||||
msgstr "SSO 认证关闭了"
|
||||
|
||||
#: authentication/errors.py:296 authentication/mixins.py:360
|
||||
#: authentication/errors.py:300 authentication/mixins.py:360
|
||||
msgid "Your password is too simple, please change it for security"
|
||||
msgstr "你的密码过于简单，为了安全，请修改"
|
||||
|
||||
#: authentication/errors.py:305 authentication/mixins.py:367
|
||||
#: authentication/errors.py:309 authentication/mixins.py:367
|
||||
msgid "You should to change your password before login"
|
||||
msgstr "登录完成前，请先修改密码"
|
||||
|
||||
#: authentication/errors.py:314 authentication/mixins.py:374
|
||||
#: authentication/errors.py:318 authentication/mixins.py:374
|
||||
msgid "Your password has expired, please reset before logging in"
|
||||
msgstr "您的密码已过期，先修改再登录"
|
||||
|
||||
#: authentication/errors.py:348
|
||||
#: authentication/errors.py:352
|
||||
msgid "Your password is invalid"
|
||||
msgstr "您的密码无效"
|
||||
|
||||
#: authentication/errors.py:353
|
||||
#: authentication/errors.py:357
|
||||
msgid "Please enter MFA code"
|
||||
msgstr "请输入 MFA 验证码"
|
||||
|
||||
#: authentication/errors.py:358
|
||||
#: authentication/errors.py:362
|
||||
msgid "Please enter SMS code"
|
||||
msgstr "请输入短信验证码"
|
||||
|
||||
#: authentication/errors.py:363 users/exceptions.py:15
|
||||
#: authentication/errors.py:367 users/exceptions.py:15
|
||||
msgid "Phone not set"
|
||||
msgstr "手机号没有设置"
|
||||
|
||||
|
|
@ -1818,7 +1824,7 @@ msgid "Show"
|
|||
msgstr "显示"
|
||||
|
||||
#: authentication/templates/authentication/_access_key_modal.html:66
|
||||
#: settings/serializers/security.py:42 users/models/user.py:458
|
||||
#: settings/serializers/security.py:39 users/models/user.py:458
|
||||
#: users/serializers/profile.py:99 users/templates/users/mfa_setting.html:60
|
||||
#: users/templates/users/user_verify_mfa.html:36
|
||||
msgid "Disable"
|
||||
|
|
@ -3326,49 +3332,53 @@ msgstr "必须包含数字"
|
|||
msgid "Must contain special"
|
||||
msgstr "必须包含特殊字符"
|
||||
|
||||
#: settings/serializers/security.py:43
|
||||
msgid "All users"
|
||||
msgstr "所有用户"
|
||||
|
||||
#: settings/serializers/security.py:44
|
||||
msgid "Only admin users"
|
||||
msgstr "仅管理员"
|
||||
|
||||
#: settings/serializers/security.py:46
|
||||
msgid "Global MFA auth"
|
||||
msgstr "全局启用 MFA 认证"
|
||||
|
||||
#: settings/serializers/security.py:50
|
||||
msgid "Limit the number of login failures"
|
||||
msgstr "限制登录失败次数"
|
||||
|
||||
#: settings/serializers/security.py:54
|
||||
msgid "Block logon interval"
|
||||
msgstr "禁止登录时间间隔"
|
||||
|
||||
#: settings/serializers/security.py:56
|
||||
#: settings/serializers/security.py:31
|
||||
msgid ""
|
||||
"Unit: minute, If the user has failed to log in for a limited number of "
|
||||
"times, no login is allowed during this time interval."
|
||||
msgstr "单位：分, 当用户登录失败次数达到限制后，那么在此时间间隔内禁止登录"
|
||||
|
||||
#: settings/serializers/security.py:61
|
||||
msgid "Login IP Black List"
|
||||
msgstr "登录 IP 黑名单"
|
||||
#: settings/serializers/security.py:40
|
||||
msgid "All users"
|
||||
msgstr "所有用户"
|
||||
|
||||
#: settings/serializers/security.py:41
|
||||
msgid "Only admin users"
|
||||
msgstr "仅管理员"
|
||||
|
||||
#: settings/serializers/security.py:43
|
||||
msgid "Global MFA auth"
|
||||
msgstr "全局启用 MFA 认证"
|
||||
|
||||
#: settings/serializers/security.py:47
|
||||
msgid "Limit the number of user login failures"
|
||||
msgstr "限制用户登录失败次数"
|
||||
|
||||
#: settings/serializers/security.py:51
|
||||
msgid "Block user login interval"
|
||||
msgstr "禁止用户登录时间间隔"
|
||||
|
||||
#: settings/serializers/security.py:56
|
||||
msgid "Limit the number of IP login failures"
|
||||
msgstr "限制 IP 登录失败次数"
|
||||
|
||||
#: settings/serializers/security.py:60
|
||||
msgid "Block IP login interval"
|
||||
msgstr "禁止 IP 登录时间间隔"
|
||||
|
||||
#: settings/serializers/security.py:64
|
||||
msgid ""
|
||||
"Format for comma-delimited string. Such as: 192.168.10.1, 192.168.1.0/24, "
|
||||
"10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:db8:1a:1110::/64"
|
||||
msgstr ""
|
||||
"格式为逗号分隔的字符串。例如: 192.168.10.1, 192.168.1.0/24, "
|
||||
"10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:db8:1a:1110::/64 （支持网域）"
|
||||
msgid "Login IP White List"
|
||||
msgstr "IP 登录白名单"
|
||||
|
||||
#: settings/serializers/security.py:70
|
||||
#: settings/serializers/security.py:69
|
||||
msgid "Login IP Black List"
|
||||
msgstr "IP 登录黑名单"
|
||||
|
||||
#: settings/serializers/security.py:75
|
||||
msgid "User password expiration"
|
||||
msgstr "用户密码过期时间"
|
||||
|
||||
#: settings/serializers/security.py:72
|
||||
#: settings/serializers/security.py:77
|
||||
msgid ""
|
||||
"Unit: day, If the user does not update the password during the time, the "
|
||||
"user password will expire failure;The password expiration reminder mail will "
|
||||
|
|
@ -3378,55 +3388,55 @@ msgstr ""
|
|||
"单位：天, 如果用户在此期间没有更新密码，用户密码将过期失效； 密码过期提醒邮件"
|
||||
"将在密码过期前5天内由系统（每天）自动发送给用户"
|
||||
|
||||
#: settings/serializers/security.py:79
|
||||
#: settings/serializers/security.py:84
|
||||
msgid "Number of repeated historical passwords"
|
||||
msgstr "不能设置近几次密码"
|
||||
|
||||
#: settings/serializers/security.py:81
|
||||
#: settings/serializers/security.py:86
|
||||
msgid ""
|
||||
"Tip: When the user resets the password, it cannot be the previous n "
|
||||
"historical passwords of the user"
|
||||
msgstr "提示：用户重置密码时，不能为该用户前几次使用过的密码"
|
||||
|
||||
#: settings/serializers/security.py:86
|
||||
#: settings/serializers/security.py:91
|
||||
msgid "Only single device login"
|
||||
msgstr "仅一台设备登录"
|
||||
|
||||
#: settings/serializers/security.py:87
|
||||
#: settings/serializers/security.py:92
|
||||
msgid "Next device login, pre login will be logout"
|
||||
msgstr "下个设备登录，上次登录会被顶掉"
|
||||
|
||||
#: settings/serializers/security.py:90
|
||||
#: settings/serializers/security.py:95
|
||||
msgid "Only exist user login"
|
||||
msgstr "仅已存在用户登录"
|
||||
|
||||
#: settings/serializers/security.py:91
|
||||
#: settings/serializers/security.py:96
|
||||
msgid "If enable, CAS、OIDC auth will be failed, if user not exist yet"
|
||||
msgstr "开启后，如果系统中不存在该用户，CAS、OIDC 登录将会失败"
|
||||
|
||||
#: settings/serializers/security.py:94
|
||||
#: settings/serializers/security.py:99
|
||||
msgid "Only from source login"
|
||||
msgstr "仅从用户来源登录"
|
||||
|
||||
#: settings/serializers/security.py:95
|
||||
#: settings/serializers/security.py:100
|
||||
msgid "Only log in from the user source property"
|
||||
msgstr "开启后，如果用户来源为本地，CAS、OIDC 登录将会失败"
|
||||
|
||||
#: settings/serializers/security.py:99
|
||||
#: settings/serializers/security.py:104
|
||||
msgid "MFA verify TTL"
|
||||
msgstr "MFA 校验有效期"
|
||||
|
||||
#: settings/serializers/security.py:101
|
||||
#: settings/serializers/security.py:106
|
||||
msgid ""
|
||||
"Unit: second, The verification MFA takes effect only when you view the "
|
||||
"account password"
|
||||
msgstr "单位: 秒, 目前仅在查看账号密码校验 MFA 时生效"
|
||||
|
||||
#: settings/serializers/security.py:106
|
||||
#: settings/serializers/security.py:111
|
||||
msgid "Enable Login dynamic code"
|
||||
msgstr "启用登录附加码"
|
||||
|
||||
#: settings/serializers/security.py:107
|
||||
#: settings/serializers/security.py:112
|
||||
msgid ""
|
||||
"The password and additional code are sent to a third party authentication "
|
||||
"system for verification"
|
||||
|
|
@ -3434,96 +3444,96 @@ msgstr ""
|
|||
"密码和附加码一并发送给第三方认证系统进行校验, 如：有的第三方认证系统，需要 密"
|
||||
"码+6位数字 完成认证"
|
||||
|
||||
#: settings/serializers/security.py:112
|
||||
#: settings/serializers/security.py:117
|
||||
msgid "MFA in login page"
|
||||
msgstr "MFA 在登录页面输入"
|
||||
|
||||
#: settings/serializers/security.py:113
|
||||
#: settings/serializers/security.py:118
|
||||
msgid "Eu security regulations(GDPR) require MFA to be on the login page"
|
||||
msgstr "欧盟数据安全法规(GDPR) 要求 MFA 在登录页面，来确保系统登录安全"
|
||||
|
||||
#: settings/serializers/security.py:116
|
||||
#: settings/serializers/security.py:121
|
||||
msgid "Enable Login captcha"
|
||||
msgstr "启用登录验证码"
|
||||
|
||||
#: settings/serializers/security.py:117
|
||||
#: settings/serializers/security.py:122
|
||||
msgid "Enable captcha to prevent robot authentication"
|
||||
msgstr "开启验证码，防止机器人登录"
|
||||
|
||||
#: settings/serializers/security.py:137
|
||||
#: settings/serializers/security.py:142
|
||||
msgid "Enable terminal register"
|
||||
msgstr "终端注册"
|
||||
|
||||
#: settings/serializers/security.py:139
|
||||
#: settings/serializers/security.py:144
|
||||
msgid ""
|
||||
"Allow terminal register, after all terminal setup, you should disable this "
|
||||
"for security"
|
||||
msgstr "是否允许终端注册，当所有终端启动后，为了安全应该关闭"
|
||||
|
||||
#: settings/serializers/security.py:143
|
||||
#: settings/serializers/security.py:148
|
||||
msgid "Enable watermark"
|
||||
msgstr "开启水印"
|
||||
|
||||
#: settings/serializers/security.py:144
|
||||
#: settings/serializers/security.py:149
|
||||
msgid "Enabled, the web session and replay contains watermark information"
|
||||
msgstr "启用后，Web 会话和录像将包含水印信息"
|
||||
|
||||
#: settings/serializers/security.py:148
|
||||
#: settings/serializers/security.py:153
|
||||
msgid "Connection max idle time"
|
||||
msgstr "连接最大空闲时间"
|
||||
|
||||
#: settings/serializers/security.py:149
|
||||
#: settings/serializers/security.py:154
|
||||
msgid "If idle time more than it, disconnect connection Unit: minute"
|
||||
msgstr "提示：如果超过该配置没有操作，连接会被断开 （单位：分）"
|
||||
|
||||
#: settings/serializers/security.py:152
|
||||
#: settings/serializers/security.py:157
|
||||
msgid "Remember manual auth"
|
||||
msgstr "保存手动输入密码"
|
||||
|
||||
#: settings/serializers/security.py:155
|
||||
#: settings/serializers/security.py:160
|
||||
msgid "Enable change auth secure mode"
|
||||
msgstr "启用改密安全模式"
|
||||
|
||||
#: settings/serializers/security.py:158
|
||||
#: settings/serializers/security.py:163
|
||||
msgid "Insecure command alert"
|
||||
msgstr "危险命令告警"
|
||||
|
||||
#: settings/serializers/security.py:161
|
||||
#: settings/serializers/security.py:166
|
||||
msgid "Email recipient"
|
||||
msgstr "邮件收件人"
|
||||
|
||||
#: settings/serializers/security.py:162
|
||||
#: settings/serializers/security.py:167
|
||||
msgid "Multiple user using , split"
|
||||
msgstr "多个用户，使用 , 分割"
|
||||
|
||||
#: settings/serializers/security.py:165
|
||||
#: settings/serializers/security.py:170
|
||||
msgid "Batch command execution"
|
||||
msgstr "批量命令执行"
|
||||
|
||||
#: settings/serializers/security.py:166
|
||||
#: settings/serializers/security.py:171
|
||||
msgid "Allow user run batch command or not using ansible"
|
||||
msgstr "是否允许用户使用 ansible 执行批量命令"
|
||||
|
||||
#: settings/serializers/security.py:169
|
||||
#: settings/serializers/security.py:174
|
||||
msgid "Session share"
|
||||
msgstr "会话分享"
|
||||
|
||||
#: settings/serializers/security.py:170
|
||||
#: settings/serializers/security.py:175
|
||||
msgid "Enabled, Allows user active session to be shared with other users"
|
||||
msgstr "开启后允许用户分享已连接的资产会话给它人，协同工作"
|
||||
|
||||
#: settings/serializers/security.py:173
|
||||
#: settings/serializers/security.py:178
|
||||
msgid "Remote Login Protection"
|
||||
msgstr "异地登录保护"
|
||||
|
||||
#: settings/serializers/security.py:175
|
||||
#: settings/serializers/security.py:180
|
||||
msgid ""
|
||||
"The system determines whether the login IP address belongs to a common login "
|
||||
"city. If the account is logged in from a common login city, the system sends "
|
||||
"a remote login reminder"
|
||||
msgstr ""
|
||||
"根据登录IP是否所属常用登录城市进行判断，若账号在非常用城市登录，会发送异地登"
|
||||
"录提醒"
|
||||
"根据登录 IP 是否所属常用登录城市进行判断，若账号在非常用城市登录，会发送异地"
|
||||
"登录提醒"
|
||||
|
||||
#: settings/serializers/sms.py:7
|
||||
msgid "Label"
|
||||
|
|
@ -6126,3 +6136,4 @@ msgstr "旗舰版"
|
|||
#: xpack/plugins/license/models.py:77
|
||||
msgid "Community edition"
|
||||
msgstr "社区版"
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
from django.utils.translation import ugettext_lazy as _
|
||||
from rest_framework import serializers
|
||||
|
||||
from common.utils.ip import is_ip_address, is_ip_network, is_ip_segment
|
||||
from acls.serializers.rules import ip_group_help_text, ip_group_child_validator
|
||||
|
||||
|
||||
class SecurityPasswordRuleSerializer(serializers.Serializer):
|
||||
|
|
@ -27,13 +27,10 @@ class SecurityPasswordRuleSerializer(serializers.Serializer):
|
|||
)
|
||||
|
||||
|
||||
def ip_child_validator(ip_child):
|
||||
is_valid = is_ip_address(ip_child) \
|
||||
or is_ip_network(ip_child) \
|
||||
or is_ip_segment(ip_child)
|
||||
if not is_valid:
|
||||
error = _('IP address invalid: `{}`').format(ip_child)
|
||||
raise serializers.ValidationError(error)
|
||||
login_ip_limit_time_help_text = _(
|
||||
'Unit: minute, If the user has failed to log in for a limited number of times, '
|
||||
'no login is allowed during this time interval.'
|
||||
)
|
||||
|
||||
|
||||
class SecurityAuthSerializer(serializers.Serializer):
|
||||
|
|
@ -47,23 +44,31 @@ class SecurityAuthSerializer(serializers.Serializer):
|
|||
)
|
||||
SECURITY_LOGIN_LIMIT_COUNT = serializers.IntegerField(
|
||||
min_value=3, max_value=99999,
|
||||
label=_('Limit the number of login failures')
|
||||
label=_('Limit the number of user login failures')
|
||||
)
|
||||
SECURITY_LOGIN_LIMIT_TIME = serializers.IntegerField(
|
||||
min_value=5, max_value=99999, required=True,
|
||||
label=_('Block logon interval'),
|
||||
help_text=_(
|
||||
'Unit: minute, If the user has failed to log in for a limited number of times, '
|
||||
'no login is allowed during this time interval.'
|
||||
)
|
||||
label=_('Block user login interval'),
|
||||
help_text=login_ip_limit_time_help_text
|
||||
)
|
||||
SECURITY_LOGIN_IP_LIMIT_COUNT = serializers.IntegerField(
|
||||
min_value=3, max_value=99999,
|
||||
label=_('Limit the number of IP login failures')
|
||||
)
|
||||
SECURITY_LOGIN_IP_LIMIT_TIME = serializers.IntegerField(
|
||||
min_value=5, max_value=99999, required=True,
|
||||
label=_('Block IP login interval'),
|
||||
help_text=login_ip_limit_time_help_text
|
||||
)
|
||||
SECURITY_LOGIN_IP_WHITE_LIST = serializers.ListField(
|
||||
default=[], label=_('Login IP White List'), allow_empty=True,
|
||||
child=serializers.CharField(max_length=1024, validators=[ip_group_child_validator]),
|
||||
help_text=ip_group_help_text
|
||||
)
|
||||
SECURITY_LOGIN_IP_BLACK_LIST = serializers.ListField(
|
||||
default=[], label=_('Login IP Black List'), allow_empty=True,
|
||||
child=serializers.CharField(max_length=1024, validators=[ip_child_validator]),
|
||||
help_text=_(
|
||||
'Format for comma-delimited string. Such as: '
|
||||
'192.168.10.1, 192.168.1.0/24, 10.1.1.1-10.1.1.20, 2001:db8:2de::e13, 2001:db8:1a:1110::/64'
|
||||
)
|
||||
child=serializers.CharField(max_length=1024, validators=[ip_group_child_validator]),
|
||||
help_text=ip_group_help_text
|
||||
)
|
||||
SECURITY_PASSWORD_EXPIRATION_TIME = serializers.IntegerField(
|
||||
min_value=1, max_value=99999, required=True,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ from django.conf import settings
|
|||
from django.core.cache import cache
|
||||
|
||||
from common.tasks import send_mail_async
|
||||
from common.utils import reverse, get_object_or_none
|
||||
from common.utils import reverse, get_object_or_none, ip
|
||||
from .models import User
|
||||
|
||||
logger = logging.getLogger('jumpserver')
|
||||
|
|
@ -180,33 +180,37 @@ class BlockGlobalIpUtilBase:
|
|||
self.ip = ip
|
||||
self.limit_key = self.LIMIT_KEY_TMPL.format(ip)
|
||||
self.block_key = self.BLOCK_KEY_TMPL.format(ip)
|
||||
self.key_ttl = int(settings.SECURITY_LOGIN_LIMIT_TIME) * 60
|
||||
self.key_ttl = int(settings.SECURITY_LOGIN_IP_LIMIT_TIME) * 60
|
||||
|
||||
@property
|
||||
def ip_in_black_list(self):
|
||||
return self.ip in settings.SECURITY_LOGIN_IP_BLACK_LIST
|
||||
return ip.contains_ip(self.ip, settings.SECURITY_LOGIN_IP_BLACK_LIST)
|
||||
|
||||
@property
|
||||
def ip_in_white_list(self):
|
||||
return ip.contains_ip(self.ip, settings.SECURITY_LOGIN_IP_WHITE_LIST)
|
||||
|
||||
def set_block_if_need(self):
|
||||
if not self.ip_in_black_list:
|
||||
if self.ip_in_white_list or self.ip_in_black_list:
|
||||
return
|
||||
count = cache.get(self.limit_key, 0)
|
||||
count += 1
|
||||
cache.set(self.limit_key, count, self.key_ttl)
|
||||
|
||||
limit_count = settings.SECURITY_LOGIN_LIMIT_COUNT
|
||||
limit_count = settings.SECURITY_LOGIN_IP_LIMIT_COUNT
|
||||
if count < limit_count:
|
||||
return
|
||||
cache.set(self.block_key, True, self.key_ttl)
|
||||
|
||||
def clean_block_if_need(self):
|
||||
if not self.ip_in_black_list:
|
||||
return
|
||||
cache.delete(self.limit_key)
|
||||
cache.delete(self.block_key)
|
||||
|
||||
def is_block(self):
|
||||
if not self.ip_in_black_list:
|
||||
if self.ip_in_white_list:
|
||||
return False
|
||||
if self.ip_in_black_list:
|
||||
return True
|
||||
return bool(cache.get(self.block_key))
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue