IP of user that caused "Authentication request has been denied"

[Roodee 37]

Hello,

is there a way to identify the IP of the computer that caused the following error:

2022-10-31 13:44:46.905 Info UserManager: Authentication request for #### has been denied.

It would be great to know if a "user" is struggling or if that is a "hack"-attempt.

Cheers,
Rudy

[chef 3745]

I'm not sure if you are a programmer, but here in my blacklist plugin, you can see the address in the Authentication_Failed event.

https://github.com/chefbennyj1/Emby.Blacklist/blob/master/Blacklist/ServerEntryPoint.cs

 

So the IP data is available. It must be processed in the logs somewhere.

 

[rbjtech 4257]

search for 'Warn, Server, AUTH-ERROR: <IP> - Invalid username or password entered' in embyserver.txt

As chef says - the actual username (if valid) is also available - along with the deviceid, password they tried (questionable if that should be logged..) plus some other info to assist you in resolving the issue for them.  Password is not logged if Auth is successful.

 

Edited November 1, 2022 by rbjtech