[Feature]: Log authentication failures with the client source IP (for fail2ban / rate limiting)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 80/100
Research direction
The 401 path is in _authorized() in serve/server.py, which returns the JSON error without logging. Start there and use the handler's self.client_address[0] for the IP. Add one line to stderr on failure, using the llama.cpp format quoted in the issue (unauthorized: Invalid API Key from <ip>). Done when a request with a wrong key prints that line and a correct key does not.
Written by the indexing model from the issue text.
Description
What do you want to do?
Please log authentication failures (HTTP 401) with the client's source IP address, so that external tools such as fail2ban can detect and ban clients that keep trying wrong API keys against the server.
Background / current behavior
The server protects /v1/* with an API key (api_key in the config, or --api-key / STRATA_API_KEY). When authentication fails, _authorized() in serve/server.py only replies with a 401 JSON body (type authentication_error, message missing or wrong API key) and returns. No log line is written, and crucially no client IP is recorded.
Because there is nothing to match on, a self-hosted deployment cannot use fail2ban (or any IP-based rate limiting) to defend against brute-force attempts on the API key, even though the server is typically exposed on the public internet (e.g. behind a router DNAT to port 8080).
What already works elsewhere / the pattern that would help
llama.cpp's server logs exactly this line on a bad key:
unauthorized: Invalid API Key from <ip>
and a fail2ban filter + nftables jail matches that line to ban the offender. Strata's 401 path currently produces no such log line at all.
Suggested outcome (goal, not a specific implementation)
A single line to stderr on an authentication failure that includes the client IP (the code already has self.client_address[0] available in the handler). Format similar to llama.cpp would let the same fail2ban filter work unchanged for both servers.
Environment
- Strata v0.1.41
- 2 × RTX 2080 Ti, 62 GiB RAM, Linux
- Server runs as a systemd service (non-root), logs land in the systemd journal
- API used via public endpoint through router DNAT to
127.0.0.1:8080
- Dominant language
- C++
- Stars
- 11.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Niko1221/Strata
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
conversation cache: once every slot holds a pinned prefix, nothing is parked any more ("skip parking ... exceeds available budget")Possibly taken @KeyanHu-git claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
Similar issues
-
agent:WSL bug linux LOW
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Build failure: limoOpen0.kind: build failure
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 Under an hour Newbie friendliness 72/100
finalburnneo/FBNeo#2803 · 1 comment ·
Maintainers usually reply within 1 day
-
ai_p1 comp-message-queues
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ClickHouse/ClickHouse#125890 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
carla-simulator/carla#9973 ·
Maintainers usually reply within 1 day