Protect manager against brute force

Hello,

A great feature would be to log, in a modx specific log file, the manager login attempts (successful or not).
I’m on a project where i can’t restrict the back-end access to specific IP’s, so I’d like to protect the manager against brute force with fail2ban.
In my mind, the CAPTCHA isn’t enough...
Currently, a failed login attempt produce nothing very specific in apache access.log... (anyway a dedicated log file would be much easier)
What do you think about it? Maybe is it already doable?

Thanks!

Kind regards,
ddub

Not being an expert on the advanced coding, but I think a plugin tied to "OnManagerLogin" can do this?

Will OnManagerLogin get triggered if the login fails?

Thanks!

Where can I find infos on these events system?

What about a snippet that logs the IP and writes it into .htaccess to block it as the attempts to login exceeds 10 times?
I´ve got such a snippet.
IM me if you´re interested in.

It will be so kind if you will share this solution.

Quote from: Katzenfutter at Apr 17, 2009, 05:18 AM

What about a snippet that logs the IP and writes it into .htaccess to block it as the attempts to login exceeds 10 times?
Iґve got such a snippet.
IM me if youґre interested in.

http://modxcms.com/forums/index.php/topic,34945.msg211936.html#msg211936

You´re welcome =)

cheers!