Configure Brute Force Protection Settings
ADOIT has a mechanism to prevent brute force attempts from gaining access to login credentials. After a specified number of failed login attempts, login to the ADOIT web client is blocked and a message is shown to the user. In order to adapt the brute force protection settings:
- Open the Admin Page. Click Authentication > Security Settings. Edit the settings and save the changes afterwards.
The following parameters are available:
max_attempts_per_ip
The maximum number of failed login attempts before an IP address is blocked for a specified amount of time. The default value is 75 times.
max_attempts_per_username
The maximum number of failed login attempts before a user name is blocked for 10 minutes. The default value is 15 times.
max_attempts_overall
The maximum number of overall failed login attempts before all users are blocked for a specified amount of time. The default value is 150 times.
sleeptime_max_attempts_per_ip
The amount of time (in milliseconds) that login attempts are blocked for an IP address after a specified amount of failed login attempts. The default value is 60,000 milliseconds (= 1 minute).
sleeptime_max_attempts_overall
The amount of time (in milliseconds) that login attempts are blocked for all users after a specified amount of overall failed login attempts. The default value is 30,000 milliseconds (= 30 seconds).
clean_up_threshold_user
Time frame (in milliseconds) in which failed attempts for a user name are accounted. The default value is 600,000 milliseconds (= 10 minutes).
clean_up_threshold_ip
Time frame (in milliseconds) in which failed attempts for an IP address are accounted. The default value is 10,800,000 milliseconds (= 3 hours).
clean_up_period
Time frame (in milliseconds) in which failed attempts for all users are accounted. The default value is 60,000 milliseconds (= 1 minute).
If there are 75 failed login attempts from an IP address
[max_attempts_per_ip
] during an interval of 3 hours
[clean_up_threshold_ip
], users on that IP address have to wait for
one minute [sleeptime_max_attempts_per_ip
].