Add IP address to auth log output #8042

Closed
opened 2025-12-29 20:31:38 +01:00 by adam · 3 comments
Owner

Originally created by @adamboutcher on GitHub (May 11, 2023).

Originally assigned to: @abhi1693 on GitHub.

NetBox version

v3.5.1

Feature type

Change to existing functionality

Proposed functionality

Change the Netbox logger (netbox.auth.login) for authentication failure to include the remote IP address, this.

Use case

The change would allow for parsing of the logs easier to detect brute force authentication attacks (i.e. Fail2Ban etc).

May 11 12:58:20 netbox NetBox: level=INFO,logger=netbox.auth.login,msg=Failed login attempt for username: test-fail
to
May 11 12:58:20 netbox NetBox: level=INFO,logger=netbox.auth.login,msg=Failed login attempt for username: test-fail from x.y.1.1

Database changes

NA.

External dependencies

This may have to use the X-Real-IP header?

Originally created by @adamboutcher on GitHub (May 11, 2023). Originally assigned to: @abhi1693 on GitHub. ### NetBox version v3.5.1 ### Feature type Change to existing functionality ### Proposed functionality Change the Netbox logger (netbox.auth.login) for authentication failure to include the remote IP address, this. ### Use case The change would allow for parsing of the logs easier to detect brute force authentication attacks (i.e. Fail2Ban etc). `May 11 12:58:20 netbox NetBox: level=INFO,logger=netbox.auth.login,msg=Failed login attempt for username: test-fail` to `May 11 12:58:20 netbox NetBox: level=INFO,logger=netbox.auth.login,msg=Failed login attempt for username: test-fail from x.y.1.1` ### Database changes NA. ### External dependencies This may have to use the X-Real-IP header?
adam added the status: acceptedtype: feature labels 2025-12-29 20:31:38 +01:00
adam closed this issue 2025-12-29 20:31:38 +01:00
Author
Owner

@adamboutcher commented on GitHub (May 18, 2023):

Possibly need the output to be easier to parse?

Such as:
May 11 12:58:20 netbox NetBox: level=INFO,logger=netbox.auth.login,msg=Failed login attempt; username: test-fail; from: x.y.1.1;

You could parse using the delimiters ; then :

@adamboutcher commented on GitHub (May 18, 2023): Possibly need the output to be easier to parse? Such as: `May 11 12:58:20 netbox NetBox: level=INFO,logger=netbox.auth.login,msg=Failed login attempt; username: test-fail; from: x.y.1.1;` You could parse using the delimiters ; then :
Author
Owner

@DanSheps commented on GitHub (May 18, 2023):

I noticed you are using 3.4.2. I am assuming this is still present in 3.5.1, however could you confirm this on 3.5.1 and update your FR?

@DanSheps commented on GitHub (May 18, 2023): I noticed you are using 3.4.2. I am assuming this is still present in 3.5.1, however could you confirm this on 3.5.1 and update your FR?
Author
Owner

@adamboutcher commented on GitHub (May 22, 2023):

I noticed you are using 3.4.2. I am assuming this is still present in 3.5.1, however could you confirm this on 3.5.1 and update your FR?

Yes, still the same in 3.5.1, updated the original post to reflect this.

@adamboutcher commented on GitHub (May 22, 2023): > I noticed you are using 3.4.2. I am assuming this is still present in 3.5.1, however could you confirm this on 3.5.1 and update your FR? Yes, still the same in 3.5.1, updated the original post to reflect this.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#8042