Question about Login Security Settings

[yuri]

Both can function at the same time, they are implemented as hooks. While the first one is always on, the second is enabled with 'authUsernameFailedAttemptsLimitEnabled'.

[ThomasB]

Yes, I know the page.
You can only use one or the other method I think? And not both at the same time.

[yuri]

There's also another mechanism preventing brute force for an IP address.

Parameters for both are available in docs: https://docs.espocrm.com/administrat...for-ip-address

We don't have a mechanism to block the user completely. We intentionally didn't add such a feature.

[yuri]

It works the way I described in my previous post. It does not block but produces a delay. The response returned with a delay.

[ThomasB]

Hm, ok. This makes testing a bit more difficult with the known IP.

But my question remains: Do I have to set authUsernameFailedAttemptsPeriod or has it a default, if not set?

My assumption was that I could block users from login again, after x numbers of failed attempts for x minutes

[yuri]

Hi Tomas,

'authUsernameFailedAttemptsDelay' is a delay in seconds before the response is returned. Fired only if the attempts number exceeds the limit (authMaxUsernameFailedAttemptNumber) within the time period (authUsernameFailedAttemptsPeriod). It helps preventing brute force attacks. Ignored for known IP addresses (a user under the same IP address logged in before), to minimize intentional account locking.

[ThomasB]

Hi,
I added these settings to the config.php file but it seems that I'm only blocked after 12 attempts?

'authUsernameFailedAttemptsLimitEnabled' => true,
'authMaxUsernameFailedAttemptNumber' => 6,
'authUsernameFailedAttemptsDelay' => 300,

I tried 11 times to enter with a false password and recevie the message: wrong username/password.
When I tried it the 12th time I got access denied.

Also I think I set the delay to 5 minutues but I can login way faster than that again.

I'm using the latest esprocrm version 9.3.9

Do I need to set authUsernameFailedAttemptsPeriod also?