From 20ab381076e643588a905ca21f27c71d19485f10 Mon Sep 17 00:00:00 2001
From: Miguel N <miguel456@spacejewel-hosting.com>
Date: Tue, 8 Sep 2020 01:26:27 +0100
Subject: [PATCH] Added logging for failed authentication attempts

---
 app/Listeners/LogAuthenticationFailure.php | 36 ++++++++++++++++++++++
 app/Providers/EventServiceProvider.php     |  5 +++
 2 files changed, 41 insertions(+)
 create mode 100644 app/Listeners/LogAuthenticationFailure.php

diff --git a/app/Listeners/LogAuthenticationFailure.php b/app/Listeners/LogAuthenticationFailure.php
new file mode 100644
index 0000000..979c2e3
--- /dev/null
+++ b/app/Listeners/LogAuthenticationFailure.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Listeners;
+
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Support\Facades\Log;
+
+class LogAuthenticationFailure
+{
+    /**
+     * Create the event listener.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        //
+    }
+
+    /**
+     * Handle the event.
+     *
+     * @param  object  $event
+     * @return void
+     */
+    public function handle($event)
+    {
+        Log::alert('SECURITY (login): Detected failed authentication attempt!', [
+            'targetAccountID' => $event->user->id,
+            'sourceIP' => request()->ip(),
+            'matchesAccountLastIP' => request()->ip() == $event->user->originalIP,
+            'sourceUserAgent' => request()->userAgent(),
+        ]);
+    }
+}
diff --git a/app/Providers/EventServiceProvider.php b/app/Providers/EventServiceProvider.php
index b2e8019..0f5a7d2 100644
--- a/app/Providers/EventServiceProvider.php
+++ b/app/Providers/EventServiceProvider.php
@@ -2,7 +2,9 @@
 
 namespace App\Providers;
 
+use App\Listeners\LogAuthenticationFailure;
 use App\Listeners\OnUserRegistration;
+use Illuminate\Auth\Events\Failed;
 use Illuminate\Auth\Events\Registered;
 use Illuminate\Auth\Listeners\SendEmailVerificationNotification;
 use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider;
@@ -20,6 +22,9 @@ class EventServiceProvider extends ServiceProvider
             SendEmailVerificationNotification::class,
             OnUserRegistration::class
         ],
+        Failed::class => [
+            LogAuthenticationFailure::class
+        ],
         'App\Events\ApplicationApprovedEvent' => [
             'App\Listeners\PromoteUser'
         ],