Bug 25935 - Use time-based mechanism for account lockout
Summary: Use time-based mechanism for account lockout
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 18314
Blocks:
  Show dependency treegraph
 
Reported: 2020-07-06 02:18 UTC by David Cook
Modified: 2020-07-20 07:57 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2020-07-06 02:18:52 UTC
Bug 18314 added account lockout for failed logins, but it's a hard lockout which doesn't expire. While this has benefits, it does add administrative overhead.

A well-crafted brute force attack could lock out all users permanently at present.

A time-based mechanism could unlock the account after 15 minutes or so, and further lockouts could get increasingly large lockout durations.