create soft block for user login [#1033418]

hey

i thought, it would be useful to have a Maximum number of login failures before soft blocking a user.
same thing as normal user login block, except, "This protection is efective during the time indicated at tracking time opion."

example:
Maximum number of login failures before detecting an ongoing attack: 10
Maximum number of login failures before soft blocking a user: 5
Maximum number of login failures before blocking a user: 10
Maximum number of login failures before soft blocking a host: 25
Maximum number of login failures before blocking a host: 50

Comment	File	Size	Author
#4	login_security-1033418-4-user-soft-blocking.patch	5.78 KB	knyshuk.vova
#4

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

doublejosh CreditAttribution: doublejosh commented 13 October 2011 at 03:55

Agreed. In fact this is the one thing I wanted from the module.

Comment #2

ben.bunk CreditAttribution: ben.bunk commented 18 April 2012 at 16:30

Has anyone started work on this? I'd like to sync up before I begin implementing it if there's already work done.

Comment #3

deekayen CreditAttribution: deekayen commented 6 February 2013 at 16:11

Version:

6.x-1.x-dev

» 7.x-1.x-dev

Bumping version.

Comment #4

knyshuk.vova CreditAttribution: knyshuk.vova at Internetdevels, Drupal Ukraine Community commented 23 November 2018 at 14:58

Issue summary:

View changes

File	Size
login_security-1033418-4-user-soft-blocking.patch	5.78 KB

I think would be great to allow the administrator to choose how to block the user. Will it be blocking completely or blocking with automatic unlocking after a certain time.

The patch attached.

Added checkbox "Enable soft user blocking"

If this checked than the user will not be able to submit the log in form again if specified number of login failures reached.
This protection is effective during the time indicated at track time option. When the track time is passed, the expired records with unsuccessful login attempts will be removed based on their creation time and the user will be able to reuse their login attempts. The user will not be blocked completely. The user still can use reset password form to recover their password and login with one-time login link.

Comment #5

knyshuk.vova CreditAttribution: knyshuk.vova at Internetdevels, Drupal Ukraine Community commented 23 November 2018 at 15:12

Important

To use soft user blocking you need to configure Drupal's flood system.
Drupal don't allow login if the failed attempts limit (flood limit) for this user has been reached. The flood system by default allow 5 failed attempts every 6 hours and cleansed expired attempts after cron execution. The flood limit should be increased to avoid conflicts between similar functionality. For example it may be increased to 500. Otherwise, the user will be blocked by default flood system.