block user at too many wrong logins

rey90 · Post by **rey90** » 01 Oct 2012, 08:41

Hello all

is it possible to block/deny the access for a user which has typed 5 times the wrong password?
So he can´t login for 5min?
Otherwise Brute-Force Attack is possbile...

Thanks for your help

Regards
Rey90

Wolfgangf · Post by **Wolfgangf** » 01 Oct 2012, 09:10

you'd want to implement fail2ban probably ...
That's at least how I do it
BR

rey90 · Post by **rey90** » 01 Oct 2012, 09:14

thanks. could you please explain this a little bit and maybe post a link

Wolfgangf · Post by **Wolfgangf** » 01 Oct 2012, 09:15

here's the link http://www.fail2ban.org/wiki/index.php/Main_Page

Idea is pretty simple: check logfiles for pattern and if a configured number of this pattern occor in the logfile: block the user

BR

rey90 · Post by **rey90** » 01 Oct 2012, 09:19

thanks for the quick answer, any other possiblities?

Post by **jojo** » 01 Oct 2012, 12:52

you can change the behaviour via sysconfig in "PreferencesGroups###Password"

rey90 · Post by **rey90** » 02 Oct 2012, 16:34

i can only change the password lengh and charakters requiered, but there is no option: "Block after x wrong logins" or im i wrong?

Post by **jojo** » 02 Oct 2012, 16:53

there is PasswordMaxLoginFailed for agents, there is no such setting for customers yet

rey90 · Post by **rey90** » 05 Oct 2012, 11:56

ok thanks for that info. a option for the customer would be nice.. i will post it @otrsideas

Znuny and ((OTRS)) Community Edition

block user at too many wrong logins

block user at too many wrong logins

Re: block user at too many wrong logins

Re: block user at too many wrong logins

Re: block user at too many wrong logins

Re: block user at too many wrong logins

Re: block user at too many wrong logins

Re: block user at too many wrong logins

Re: block user at too many wrong logins

Re: block user at too many wrong logins