Locking Out Bad Users
By default, if you enter a bad password more than five times within 10 minutes, your account is automatically locked out. In other words, it is disabled.
Also, if you enter the wrong answer for the password answer more than five times in a 10-minute interval, your account is locked out. You get five attempts at your password and five attempts at your password answer. (These two things are tracked independently.)
Two configuration settings control when an account gets locked out:
• maxInvalidPasswordAttempts—
The maximum number of bad passwords or bad password answers that you are allowed to enter (The default value is 5.)
• passwordAttemptWindow—
The time interval in minutes in which entering bad passwords or bad password ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access