Skip to content

Commit f6323e8

Browse files
committed
Add minimum username length requirement and ability to provide a username blacklist.
1 parent b3c0459 commit f6323e8

File tree

2 files changed

+116
-1
lines changed

2 files changed

+116
-1
lines changed

configuration.example.php

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,4 +170,97 @@
170170
'denied_ip' => [],
171171
],
172172
'public_keys' => [],
173+
];
174+
175+
// Add a minimum length for usernames (set to 0 to ignore length):
176+
$username_minimum_length = 4;
177+
178+
// This list of usernames will simply be ignored completed (no LDAP authentication will occur):
179+
$username_blacklist = [
180+
'admin',
181+
'apagar',
182+
'auto',
183+
'bananapi',
184+
'bdadmin',
185+
'billing',
186+
'bin',
187+
'crm',
188+
'csgoserver',
189+
'deploy',
190+
'eas',
191+
'escaner',
192+
'factorio',
193+
'fedena',
194+
'fernando',
195+
'ftp',
196+
'ftp_id',
197+
'ftpserver',
198+
'ftpuser',
199+
'furukawa',
200+
'gc',
201+
'git',
202+
'gitblit',
203+
'gmod',
204+
'guest',
205+
'hxeadm',
206+
'ircd',
207+
'kafka',
208+
'kk',
209+
'koha',
210+
'kms',
211+
'mariadb',
212+
'minecraft',
213+
'mysql',
214+
'node',
215+
'odoo',
216+
'oozie',
217+
'openvpn',
218+
'operator',
219+
'oracle',
220+
'pcguest',
221+
'pi',
222+
'platform',
223+
'plcmspip',
224+
'postgres',
225+
'prueba',
226+
'prueba1',
227+
'rpm',
228+
'root',
229+
'rs',
230+
'sample',
231+
'secretaria',
232+
'shutdown',
233+
'sinus',
234+
'squadserver',
235+
'steam',
236+
'student',
237+
'student10',
238+
'support',
239+
'sysadmin',
240+
'teacher',
241+
'teacher1',
242+
'teamspeak',
243+
'temp',
244+
'test',
245+
'test1',
246+
'test001',
247+
'teste',
248+
'testftp',
249+
'trinity',
250+
'ts3',
251+
'ts3bot',
252+
'ubuntu',
253+
'user',
254+
'usuario',
255+
'uploader',
256+
'vbox',
257+
'vboxuser',
258+
'voip',
259+
'vyos',
260+
'web5',
261+
'webftp',
262+
'www',
263+
'www-data',
264+
'zabbix',
265+
'zte',
173266
];

functions.php

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,16 @@ function authenticateUser() {
3030
if (!empty($data)) {
3131

3232
try {
33-
global $connections, $domains_to_strip_automatically, $convert_username_to_lowercase;
33+
global $connections, $domains_to_strip_automatically, $convert_username_to_lowercase, $username_minimum_length, $username_blacklist;
3434

35+
// Convert username to lowercase if setting is enabled:
3536
if (isset($convert_username_to_lowercase) && $convert_username_to_lowercase === true) {
37+
$beforeUsername = $data['username'];
3638
$data['username'] = strtolower($data['username']);
39+
40+
if ($beforeUsername !== $data['username']) {
41+
logMessage('Converted ' . $beforeUsername . ' to ' . $data['username']);
42+
}
3743
}
3844

3945
// Strip specific organization email domains if provided:
@@ -46,6 +52,22 @@ function authenticateUser() {
4652
}
4753
}
4854

55+
// Prevent short usernames from being processed:
56+
if (isset($username_minimum_length) && $username_minimum_length > 0) {
57+
if (strlen($data['username']) < $username_minimum_length) {
58+
logMessage('Denying ' . $data['username'] . ' since length is less than minimum allowed (' . $username_minimum_length . ')');
59+
denyRequest();
60+
}
61+
}
62+
63+
// Prevent blacklisted usernames from being processed:
64+
if (isset($username_blacklist) && !empty($username_blacklist)) {
65+
if (array_search($data['username'], $username_blacklist) !== false) {
66+
logMessage('Denying ' . $data['username'] . ' since it is in the username blacklist');
67+
denyRequest();
68+
}
69+
}
70+
4971
foreach($connections as $connectionName => $connection) {
5072

5173
logMessage('Before connection attempt to ' . $connectionName);

0 commit comments

Comments
 (0)