Page MenuHomePhabricator

Allow logging and possibility to enact mitigations for actions for IPs with negative IP reputation data
Closed, ResolvedPublic

Description

Context

Now that iPoid-Service is running, we can make use of its data in account creation requests and other actions taken on wiki. This is useful for providing additional context into an action; it also provides for the possibility of implementing mitigations based on various signals, rather than relying on individual IPs or IP ranges for actions.

Proposal

This task proposes that an extension implements a pre authentication provider to check for the presence of an IP address used in account creation against ipoid's database.

The extension should allow for configuring which risk types (e.g. callback proxy) and tunnel types (e.g. proxy or vpn) to check account creation for.

In the short term, we'll use CentralAuth both for lack of a better place for this integration for now. Longer term, this functionality should go into MediaWiki-extensions-IPReputation

Consequences

  1. There is a central location for event logging, statsd, and logstash logs for IP reputation data associated with an action
  2. There is configuration that allows for implementing mitigations per action for IP addresses matching configured risk criteria

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 989728 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CentralAuth@master] WIP PreAuth: Deny account creation based on ipoid data

https://gerrit.wikimedia.org/r/989728

Change 990396 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Log IpReputation channel as debug

https://gerrit.wikimedia.org/r/990396

Change 990396 merged by jenkins-bot:

[operations/mediawiki-config@master] Log IpReputation channel as debug

https://gerrit.wikimedia.org/r/990396

Mentioned in SAL (#wikimedia-operations) [2024-01-14T15:20:53Z] <taavi@deploy2002> Started scap: Backport for [[gerrit:990396|Log IpReputation channel as debug (T354928)]]

Mentioned in SAL (#wikimedia-operations) [2024-01-14T15:35:12Z] <taavi@deploy2002> taavi: Backport for [[gerrit:990396|Log IpReputation channel as debug (T354928)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-01-14T15:47:42Z] <taavi@deploy2002> Finished scap: Backport for [[gerrit:990396|Log IpReputation channel as debug (T354928)]] (duration: 26m 49s)

Patch 02-T354928.patch is currently failing to apply and caused the train presync to fail last night:

[FAILED] /srv/patches/1.42.0-wmf.14/extensions/CentralAuth/02-T354928.patch

We're gonna need a rebased version to unblock the train. @taavi I think you're the right person to ping here?

Patch 02-T354928.patch is currently failing to apply and caused the train presync to fail last night:

[FAILED] /srv/patches/1.42.0-wmf.14/extensions/CentralAuth/02-T354928.patch

We're gonna need a rebased version to unblock the train. @taavi I think you're the right person to ping here?

@jnuche PS33 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/989728/ seems to not have any conflicts? I propose we merge that patch and backport it.

@kostajh sounds good to me. I'll rerun the presync, can you create the patch for 1.42.0-wmf.14 in the meantime? I'll backport it once the preysnc has completed.

Change 990752 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CentralAuth@wmf/1.42.0-wmf.14] PreAuthenticationProvider: Deny account creation based on ipoid data

https://gerrit.wikimedia.org/r/990752

Change 990752 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.42.0-wmf.14] PreAuthenticationProvider: Deny account creation based on ipoid data

https://gerrit.wikimedia.org/r/990752

Mentioned in SAL (#wikimedia-operations) [2024-01-16T11:16:03Z] <jnuche@deploy2002> Started scap: Backport for [[gerrit:990752|PreAuthenticationProvider: Deny account creation based on ipoid data (T354928)]]

Mentioned in SAL (#wikimedia-operations) [2024-01-16T11:36:03Z] <jnuche@deploy2002> jnuche and kharlan: Backport for [[gerrit:990752|PreAuthenticationProvider: Deny account creation based on ipoid data (T354928)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-01-16T11:45:35Z] <jnuche@deploy2002> Finished scap: Backport for [[gerrit:990752|PreAuthenticationProvider: Deny account creation based on ipoid data (T354928)]] (duration: 29m 32s)

Tgr subscribed.

Needs a heads-up to admins when it is merged (not sure if Tech News is the best venue for that, but it's the simplest) because some users might use the appeal mechanisms for IP blocks, and since the message and mechanism is vaguely similar to that, admins will get very confused if they are unaware that we are doing automated pseudo-IP-blocks now.

Needs a heads-up to admins when it is merged (not sure if Tech News is the best venue for that, but it's the simplest) because some users might use the appeal mechanisms for IP blocks, and since the message and mechanism is vaguely similar to that, admins will get very confused if they are unaware that we are doing automated pseudo-IP-blocks now.

My bad, this is actually not enabled yet, so doesn't need a notice right now. But at some point we do need to explain what the new error message means.

Needs a heads-up to admins when it is merged (not sure if Tech News is the best venue for that, but it's the simplest) because some users might use the appeal mechanisms for IP blocks, and since the message and mechanism is vaguely similar to that, admins will get very confused if they are unaware that we are doing automated pseudo-IP-blocks now.

My bad, this is actually not enabled yet, so doesn't need a notice right now. But at some point we do need to explain what the new error message means.

I'll plan to do that when porting the code to MediaWiki-extensions-IPReputation

Change 992123 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CentralAuth@wmf/1.42.0-wmf.15] PreAuthenticationProvider: Allow blocking account creation based on IP reputation

https://gerrit.wikimedia.org/r/992123

Change 989728 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] PreAuthenticationProvider: Allow blocking account creation based on IP reputation

https://gerrit.wikimedia.org/r/989728

Change 992123 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.42.0-wmf.15] PreAuthenticationProvider: Allow blocking account creation based on IP reputation

https://gerrit.wikimedia.org/r/992123

Mentioned in SAL (#wikimedia-operations) [2024-01-25T08:16:12Z] <stran@deploy2002> Started scap: Backport for [[gerrit:992123|PreAuthenticationProvider: Allow blocking account creation based on IP reputation (T354928)]]

Mentioned in SAL (#wikimedia-operations) [2024-01-25T08:44:58Z] <stran@deploy2002> stran and kharlan: Backport for [[gerrit:992123|PreAuthenticationProvider: Allow blocking account creation based on IP reputation (T354928)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-01-25T09:12:02Z] <stran@deploy2002> Started scap: Backport for [[gerrit:992123|PreAuthenticationProvider: Allow blocking account creation based on IP reputation (T354928)]]

Mentioned in SAL (#wikimedia-operations) [2024-01-25T09:14:16Z] <stran@deploy2002> kharlan and stran: Backport for [[gerrit:992123|PreAuthenticationProvider: Allow blocking account creation based on IP reputation (T354928)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-01-25T09:29:26Z] <stran@deploy2002> Finished scap: Backport for [[gerrit:992123|PreAuthenticationProvider: Allow blocking account creation based on IP reputation (T354928)]] (duration: 17m 24s)

kostajh renamed this task from Allow denial of account creation for IPs known to ipoid to Allow logging and possibility to enact mitigations for actions for IPs with negative IP reputation data.Mar 12 2024, 11:11 AM
kostajh claimed this task.
kostajh updated the task description. (Show Details)