Matrix

Configuration for Matrix: Synapse, Tuwunel, Continuiwity, etc.

The Client-Server APIs are standardized, so it must work with any compliant server.

Here we address only the Client-Server API. I'm not sure if it's a good idea to address the Server-Server API, but if you dig into that, please contribute!

We also only address the "legacy" login API, still widely used. If using the new Oauth2 API, the Oauth2 server's routes must be protected instead, and depend on the server used.

Legacy Login API

Documentation

Request path: POST /_matrix/client/v3/login.

The server either respond with a 200 OK, 400 Bad Request, 403 Forbidden or 429 Too Many Requests.

As servers can have built-in rate limiting, it's better to use that as a first mechanism.

However, reconnaissance bots could look for other security issues, so it's possible to use reaction to completely block the service when bruteforcing is detected.

This example makes the assumption that a function named banFor is defined. See the ipset example. It also makes the assumption that there is a pattern named ip.

A regex for nginx can look like this:

@'^<ip> .* domain.name "POST /_matrix/client/v\d/login HTTP/..." (?:400|403) '

(Adjust domain.name according to your domain)

Example:

{
  streams: {
    nginx: {
      cmd: ['...'], // see ./nginx.md
      filters: {
        directus: {
          regex: [
            @'^<ip> .* matrix.example "POST /_matrix/client/v\d/login HTTP/..." (?:400|403) '
          ],
          retry: 8,
          retryperiod: '2h',
          actions: banFor('6h'),
        },
      },
    },
  },
}