Bug 25935

Summary: Use time-based mechanism for account lockout
Product: Koha Reporter: David Cook <dcook>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dpavlin, george, jonathan.druart
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25932
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 18314    
Bug Blocks:    

Description David Cook 2020-07-06 02:18:52 UTC
Bug 18314 added account lockout for failed logins, but it's a hard lockout which doesn't expire. While this has benefits, it does add administrative overhead.

A well-crafted brute force attack could lock out all users permanently at present.

A time-based mechanism could unlock the account after 15 minutes or so, and further lockouts could get increasingly large lockout durations.