Limit the rate of logins.

lms/djangoapps/courseware/admin.py

@@ -3,7 +3,7 @@ django admin pages for courseware model
 '''
 
 from courseware.models import StudentModule, OfflineComputedGrade, OfflineComputedGradeLog
-from django.contrib import admin
+from ratelimitbackend import admin
 from django.contrib.auth.models import User
 
 admin.site.register(StudentModule)

lms/envs/common.py

@@ -236,6 +236,10 @@ TEMPLATE_CONTEXT_PROCESSORS = (
     'mitxmako.shortcuts.marketing_link_context_processor',
 )
 
+# use the ratelimit backend to prevent brute force attacks
+AUTHENTICATION_BACKENDS = (
+    'ratelimitbackend.backends.RateLimitModelBackend',
+)
 STUDENT_FILEUPLOAD_MAX_SIZE = 4 * 1000 * 1000  # 4 MB
 MAX_FILEUPLOADS_PER_INPUT = 20
 
@@ -434,10 +438,10 @@ OPEN_ENDED_GRADING_INTERFACE = {
     'url': 'http://sandbox-grader-001.m.edx.org/peer_grading',
     'username': 'incorrect_user',
     'password': 'incorrect_pass',
-    'staff_grading' : 'staff_grading',
-    'peer_grading' : 'peer_grading',
-    'grading_controller' : 'grading_controller'
-    }
+    'staff_grading': 'staff_grading',
+    'peer_grading': 'peer_grading',
+    'grading_controller': 'grading_controller'
+}
 
 # Used for testing, debugging peer grading
 MOCK_PEER_GRADING = False
@@ -492,6 +496,9 @@ MIDDLEWARE_CLASSES = (
 
     'django_comment_client.utils.ViewNameMiddleware',
     'codejail.django_integration.ConfigureCodeJailMiddleware',
+
+    # catches any uncaught RateLimitExceptions and returns a 403 instead of a 500
+    'ratelimitbackend.middleware.RateLimitMiddleware',
 )
 
 ############################### Pipeline #######################################

lms/envs/dev_edx4edx.py

@@ -1,79 +0,0 @@
-"""
-This config file runs the simplest dev environment using sqlite, and db-based
-sessions. Assumes structure:
-
-/envroot/
-        /db   # This is where it'll write the database file
-        /mitx # The location of this repo
-        /log  # Where we're going to write log files
-"""
-
-# We intentionally define lots of variables that aren't used, and
-# want to import all variables from base settings files
-# pylint: disable=W0401, W0614
-
-import socket
-
-if 'eecs1' in socket.gethostname():
-    MITX_ROOT_URL = '/mitx2'
-
-from .common import *
-from .dev import *
-
-if 'eecs1' in socket.gethostname():
-    MITX_ROOT_URL = '/mitx2'
-
-#-----------------------------------------------------------------------------
-# edx4edx content server
-
-EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
-MITX_FEATURES['REROUTE_ACTIVATION_EMAIL'] = 'ichuang@mitx.mit.edu'
-EDX4EDX_ROOT = ENV_ROOT / "data/edx4edx"
-
-#EMAIL_BACKEND = 'django_ses.SESBackend'
-
-#-----------------------------------------------------------------------------
-# ichuang
-
-DEBUG = True
-ENABLE_MULTICOURSE = True     # set to False to disable multicourse display (see lib.util.views.mitxhome)
-
-MAKO_TEMPLATES['course'] = [DATA_DIR, EDX4EDX_ROOT]
-
-#MITX_FEATURES['USE_DJANGO_PIPELINE'] = False
-MITX_FEATURES['DISPLAY_HISTOGRAMS_TO_STAFF'] = False
-MITX_FEATURES['DISPLAY_EDIT_LINK'] = True
-
-COURSE_DEFAULT = "edx4edx"
-COURSE_NAME = "edx4edx"
-COURSE_NUMBER = "edX.01"
-COURSE_TITLE = "edx4edx: edX Author Course"
-SITE_NAME = "ichuang.mitx.mit.edu"
-
-COURSE_SETTINGS =  {'edx4edx': {'number' : 'edX.01',
-                                    'title': 'edx4edx: edX Author Course',
-                                    'xmlpath': '/edx4edx/',
-                                    'github_url': 'https://github.com/MITx/edx4edx',
-                                    'active': True,
-                                    'default_chapter': 'Introduction',
-                                    'default_section': 'edx4edx_Course',
-                                    },
-                    }
-
-#-----------------------------------------------------------------------------
-
-MIDDLEWARE_CLASSES = MIDDLEWARE_CLASSES + (
-    'ssl_auth.ssl_auth.NginxProxyHeaderMiddleware',		# ssl authentication behind nginx proxy
-    )
-
-AUTHENTICATION_BACKENDS = (
-    'ssl_auth.ssl_auth.SSLLoginBackend',
-    'django.contrib.auth.backends.ModelBackend',
-    )
-
-INSTALLED_APPS = INSTALLED_APPS + (
-    'ssl_auth',
-    )
-
-LOGIN_REDIRECT_URL = MITX_ROOT_URL + '/'
-LOGIN_URL = MITX_ROOT_URL + '/'

lms/envs/test.py

@@ -15,6 +15,7 @@ sessions. Assumes structure:
 from .common import *
 import os
 from path import path
+from warnings import filterwarnings
 
 # can't test start dates with this True, but on the other hand,
 # can test everything else :)
@@ -135,6 +136,9 @@ CACHES = {
 # Dummy secret key for dev
 SECRET_KEY = '85920908f28904ed733fe576320db18cabd7b6cd'
 
+# hide ratelimit warnings while running tests
+filterwarnings('ignore', message='No request passed to the backend, unable to rate-limit')
+
 ################################## OPENID #####################################
 MITX_FEATURES['AUTH_USE_OPENID'] = True
 MITX_FEATURES['AUTH_USE_OPENID_PROVIDER'] = True

lms/urls.py

@@ -1,6 +1,6 @@
 from django.conf import settings
 from django.conf.urls import patterns, include, url
-from django.contrib import admin
+from ratelimitbackend import admin
 from django.conf.urls.static import static
 
 # Not used, the work is done in the imported module.