Orchard CMS Security and Extending Workflow Module

A new client requested a way of tracking failed logon attempts in Orchard CMS in order to help detect brute force attacks to the admin dashboard. The functionality requested isn't too much different from a blog post I wrote with regards to creating custom activites for Orchard Workflow. In that example I developed a custom workflow activity to track successful logon attempts.

Orchard Workflow Development and Extensibility

Although one can certainly develop this security feature without hooking into Orchard Workflow, the extra effort is insignificant compared to the flexibility given to the client. By creating a custom Failed Logon Attempt Activity in Orchard Workflow you give the client a lot of opportunities to use the event as they see fit.

Today, for example, the client may just be interested in logging the failed logon attempts, but later if brute force attacks to the Orchard Website become a serious problem, they may want to develop a complex workflow that is part of an escalation plan. The information obtained from the failed logon attempts ( ip address, username, date/time, etc. ) can be used to proactively mitigate DDoS Attacks, help clients during logon, and improve service realiability and security. There are no limits here as the the information can be used by any workflow activity in your Orchard Website, which is available to the client from the Orchard Admin Dashboard.

Orchard CMS Failed Logon Attempt Workflow Activity

Below is a snapshot of the Failed Logon Attempt Workflow Activity as it resides in a simple workflow that just logs the attempts. It is very simple, but as part of a custom workflow in Orchard it can become quite powerful. Of course, along with the workflow activity there are numerous Orchard Tokens that provide useful information about the logon attempt to help other workflow activities store and make decisions based on the failed logon attempt.

Orchard CMS Security and Brute Force Attacks

Conclusion

If you are an Orchard CMS Developer and you haven't learned how to extend and customize Orchard Workflows, I highly recommend you dive into the Orchard Source Code and learn. It is a powerful technique for extending Orchard Websites and putting that power into the hands of your client.

If you need assistance developing an Orchard Website, building a custom Orchard Module, upgrading an Orchard Website, or developing an Orchard Theme, please contact me.