IPban for Emby

[Luke 37116]

2 hours ago, rbjtech said:

Yep - it now appears the logs are not using the previously method..

Infact - it appears they are not formulating a decent error log at all for failed auth ..

All they appear to be logging is via the UserManager - the IP info is now in a different http response message, unrelated to the failure .. oh dear.

Luckily I use Scripter-X to send alerts via 'On Auth failure' so that continues to work just fine (I got a pushover alert with this test) but if you are using fail2ban or ipban at the server level (and not upstream on a reverse proxy) then this is now going to require some more work.

2024-04-25 16:51:53.652 Error DefaultAuthenticationProvider: Invalid username or password. No user named Baduser exists
2024-04-25 16:51:53.653 Info UserManager: Authentication request for Baduser has been denied.
2024-04-25 16:51:53.661 Debug Notifications: Sending notification: Failed Login Attempt from Baduser on <server>
2024-04-25 16:51:53.661 Error Server: Invalid username or password entered.
2024-04-25 16:51:53.661 Info Server: http/1.1 Response 403 to 1.2.3.4. Time: 10ms. POST http:/<server>/emby/Users/authenticatebyname?...
2024-04-25 16:51:53.716 Info HttpClient: POST https://api.pushover.net/1/messages.json

@Luke- Hi - Any reason why the previous log entry for failed Auth was changed ?

That's a mistake. It will be resolved in the next 4.8.X maintenance release. Thanks.

[K22R8CT 24]

Thanks. Will the fix use the same format as emby beta (below)?

2024-04-29 14:22:25.361 Warn Server: AUTH-ERROR: 10.0.1.4 - Invalid username or password entered.

 

[Luke 37116]

4 minutes ago, K22R8CT said:

Thanks. Will the fix use the same format as emby beta (below)?

2024-04-29 14:22:25.361 Warn Server: AUTH-ERROR: 10.0.1.4 - Invalid username or password entered.

 

Yes.