Question about Login Security Settings

[ThomasB]

Hi,
I added these settings to the config.php file but it seems that I'm only blocked after 12 attempts?

'authUsernameFailedAttemptsLimitEnabled' => true,
'authMaxUsernameFailedAttemptNumber' => 6,
'authUsernameFailedAttemptsDelay' => 300,

I tried 11 times to enter with a false password and recevie the message: wrong username/password.
When I tried it the 12th time I got access denied.

Also I think I set the delay to 5 minutues but I can login way faster than that again.

I'm using the latest esprocrm version 9.3.9

Do I need to set authUsernameFailedAttemptsPeriod also?

[yuri]

Hi Tomas,

'authUsernameFailedAttemptsDelay' is a delay in seconds before the response is returned. Fired only if the attempts number exceeds the limit (authMaxUsernameFailedAttemptNumber) within the time period (authUsernameFailedAttemptsPeriod). It helps preventing brute force attacks. Ignored for known IP addresses (a user under the same IP address logged in before), to minimize intentional account locking.

[ThomasB]

Hm, ok. This makes testing a bit more difficult with the known IP.

But my question remains: Do I have to set authUsernameFailedAttemptsPeriod or has it a default, if not set?

My assumption was that I could block users from login again, after x numbers of failed attempts for x minutes

[yuri]

It works the way I described in my previous post. It does not block but produces a delay. The response returned with a delay.

[yuri]

There's also another mechanism preventing brute force for an IP address.

Parameters for both are available in docs: https://docs.espocrm.com/administrat...for-ip-address

We don't have a mechanism to block the user completely. We intentionally didn't add such a feature.

[ThomasB]

Yes, I know the page.
You can only use one or the other method I think? And not both at the same time.

[yuri]

Both can function at the same time, they are implemented as hooks. While the first one is always on, the second is enabled with 'authUsernameFailedAttemptsLimitEnabled'.