Optional ability to block user account after many failed login attempts

[LukasReschke]

After many failed login attempts it may be useful to block user accounts completely. This should probably be used in combination to #492 so IPs that logged-in successfully in the past can also continue to login in the future.

Also we should send out a mail with a link that allows a user to login and bypass the limitation by trusting their IP by doing so.

[oparoz]

Not sure about trusting IPs, but blocking and mailing the user is a good idea.

[tflidd]

What about browser authentication with ssl-certs (like startssl does)? Not sure if there is an easy setup method (generation, download & install from web-interface) but such machines could have a higher trust level than other clients.

[Spacefish]

I think we shouldn't over engineer that feature. Just set a reasonable
retry rate. Like 20 attempts are no problem, than exponential back off,
starting with 5 seconds or so.

Automated dictionary attacks are mitti gated by this, but it won't affect a
user which can't remember the exact spelling of his password and tries some.

Am 02.08.2016 17:08 schrieb "tflidd" notifications@github.com:

What about browser authentication with ssl-certs (like startssl does)? Not
sure if there is an easy setup method (generation, download & install from
web-interface) but such machines could have a higher trust level than other
clients.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#493 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAW7UUBBEFOMb9C6NymXJlmcbgg6E8RHks5qb11wgaJpZM4JRk4m
.

[benediktg]

How about providing a configuration for fail2ban in the documentation?

[RaspNote]

Here I have a configuration of fail2ban (working!):

cd /etc/fail2ban
nano `fail2ban.local

Include a new section in the configuration as follow:

`[nextcloud]

filter = nextcloud
port = http,https
maxretry = X
logpath = /[YourNextCloudDataLocation]/nextcloud.log
enabled = true`

After that create a new filter

cd filter.d
nano nextcloud.conf

Write as follow:

`[INCLUDES]

before = common.conf

[Definition]

_deamon = nextcloud

failregex={"reqId":".","remoteAddr":".","app":"core","message":"Login failed: '.' (Remote IP: '')","level":2,"time":"."}

ignoreregex =`

DONE

Found at http://linuxcoffee.eu/owncloud-ultimate.php

[Hudaldadi]

What about a checkbox in the Admin Area?

[J0WI]

Would be great to have the filter from #493 (comment) somewhere documented. What would be the correct place for it?