What is important to log for failed authentication attempts?

Question

I am working on an authentication system for an online game programmed using PHP and I would like to make sure it is secure. To help with this, I think logging would be useful (and good practice for me as well as a good test for a system logging class). I dont want to use the web server's logs, but I would like to know what would be important to log for failed authentication attempts.

I've pondered some options but I don't want to miss anything important. Below is a list of what I've considered so far.

1. Nothing (maybe it's pointless?)
2. full page URL
3. username attempted
4. ip address

5. time/date

   What other things do you suggest to make sure to log?

Answer 1

Attempted password. Referrer if any (though for security reasons it's probably not much help).

Answer 2

First, what kind of concerns are on your mind?

Are you trying to find weaknesses in your software?

• Username, full Page URL, time/date

Worried about hacking?

• IP Address, username, time/date

Just trying to eat space on your server's HDD.

• Username, full page URL, ip address, time / date

:)

Answer 3

"and I would like to make sure it is secure."

No amount of logging is going to make your system more secure.

However, if your reason is to collect stats on failed attempts and look for possible problem areas (so you can, for example, ban IP addresses or accounts, or identify users with very bad memory), I would opt for logging the date, time, username, IP address and attempted password.

The IP address isn't as useful as you might think due to DHCP, NAT'ing and such but it can still be moderately useful.

None of this will prevent break-ins since a successful break-in will have the real password anyway (from social engineering or keyloggers).

We used to have a bit of fun at a major telco whose field engineers logged in to get the workload for the next few hours.

We would see them connect and get the password wrong, then look up their real password in LDAP and give them a call on the mobile. "Excuse me, Bob, but you seem to be having trouble logging in. You should be using 'octagon' as your password, not 'hexagon'."

That freaked 'em out no end and, obviously, our jobs weren't overly stressful at that point :-)