Bug 333880

Summary:	Dolphin generating too many sftp login attempts while editing location bar
Product:	[Unmaintained] kfile	Reporter:	Adriano Vilela <adriano.vilela>
Component:	kurlnavigator	Assignee:	kdelibs bugs <kdelibs-bugs-null>
Status:	RESOLVED WORKSFORME
Severity:	normal	CC:	arthur, cfeck, frank78ac, mail_noxx, nate
Priority:	NOR	Keywords:	triaged
Version First Reported In:	4.11.5
Target Milestone:	---
Platform:	Debian testing
OS:	Linux
Latest Commit:		Version Fixed/Implemented In:
Sentry Crash Report:

Description Adriano Vilela 2014-04-25 16:54:32 UTC

Hello,

I usually use dolphin to connect to a server in our network. Recently, the package "denyhosts" was installed on this server and since then my IP started being blocked. The package denyhosts blocks IPs it suspects are trying to do a brute force attack. I then looked at the /var/log/auth.log file on our server and noticed that there were many login attempts coming from my IP with different login names (which surely looks like a dictionary attack from the server perspective). After spending some time on this, I found out that this is related to dolphin. In my Places sidebar in dolphin, there's an entry for our server which reads something like

sftp://adriano@myserver.com/home/adriano

The password for this login is saved in kwallet. When I click on this entry in my Places sidebar, it logs me in as user "adriano". However, sometimes I need to log in as another user (cpqd). But in order to do that, I need to edit dolphin's address bar and change the address to

sftp://cpqd@myserver.com/home/cpqd

What happens then is that, for each character that is changed in the address, a login attempt is made. I discovered this by looking at the /var/log/auth.log file on our server, which shows a succession of failed login attempts under the following user names:

cadriano
cpadriano
cpqadriano
cpqdadriano
cpqddriano
cpqdriano
cpqdiano
cpqdano
cpqdno
cpqdo

Having programmed in Qt myself, I think I know what's going on: the widget used for the address bar sends out a Qt signal for each character changed in the address. This signal is probably connected to a slot responsible for trying to establish the connection. This explains the list above: there was initially the user "adriano" and then I typed cpqd and after that I deleted adriano. After the third or fourth login attempt with an invalid user name, my IP gets blocked.

My client is using KDE 4.11.5, from Debian Testing. The server is running Debian Stable (Wheezy).

Thanks,

Adriano


Reproducible: Always

Steps to Reproduce:
1.Log in to a server whose address is saved to the Places sidebar
2.Edit the address bar in order to log in to the same server as a different user
3.
Actual Results:  
Too many login attempts are made, resulting in the package denyhosts in the server blocking my IP address.

Comment 1 Christoph Feck 2014-04-27 11:13:01 UTC

Try right-clicking on the address line, and change "Text Completion" to "None".

Comment 2 Adriano Vilela 2014-04-28 11:17:26 UTC

@Christoph

Thanks for your comment. Changing text completion to "None" indeed seems to solve the problem.

Right now, I have one entry on my Places sidebar per machine I log in to. I guess another solution would be to have one entry per user/machine combination so that I wouldn't need to edit the address bar directly.

By the way, is there any way of knowing if I'm currently logged in to a machine or not? When I log in to a machine, there's no indication on the places bar. This is different from some other systems, where an eject button is drawn to the side of the machines currently connected. This makes it clear to the user the a given machine is currently connected to, and gives the user a clear way to disconnect (in dolphin I just close the window hoping that will close the connection immediately).

Thank you,

Adriano

Comment 3 Frank Reininghaus 2014-04-28 13:14:04 UTC

Reassigning to the KUrlNavigator class, which provides the location bar in Dolphin and the file dialog.

Comment 4 Frank Reininghaus 2014-04-28 13:14:43 UTC

*** Bug 328002 has been marked as a duplicate of this bug. ***

Comment 5 Christoph Feck 2014-05-04 21:17:25 UTC

> By the way, is there any way of knowing if I'm currently logged in to a machine or not?

Please create a ticket for this feature separately, it might indeed be useful.

Comment 6 Nate Graham 2018-06-15 03:44:46 UTC

Is this still relevant or applicable with KDE Frameworks 5.47?

Comment 7 Andrew Crouthamel 2018-09-28 03:38:21 UTC

Dear Bug Submitter,

This bug has been in NEEDSINFO status with no change for at least 15 days. Please provide the requested information as soon as possible and set the bug status as REPORTED. Due to regular bug tracker maintenance, if the bug is still in NEEDSINFO status with no change in 30 days, the bug will be closed as RESOLVED > WORKSFORME due to lack of needed information.

For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

If you have already provided the requested information, please set the bug status as REPORTED so that the KDE team knows that the bug is ready to be confirmed.

Thank you for helping us make KDE software even better for everyone!

Comment 8 Andrew Crouthamel 2018-10-29 02:06:00 UTC

Dear Bug Submitter,

This bug has been in NEEDSINFO status with no change for at least 30 days. The bug is now closed as RESOLVED > WORKSFORME due to lack of needed information.

For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

Thank you for helping us make KDE software even better for everyone!