Context Navigation

← Previous Changeset
Next Changeset →

Changeset 607721

Timestamp:

10/04/2012 01:05:10 AM (13 years ago)

Author:

convissor

Message:

Fix formatting of lockout/slowdown faq.

File:

: 1 edited

Legend:

: Unmodified
: Added
: Removed

login-security-solution/trunk/readme.txt

-                      r607720
+                      r607721
 Solution.
     __Limit Login Attempts__
     * _Invalid or Valid Credentials by Attacker or Actual User_
 ) Process authentication request (check IP address)
 ) Error message: "Too many failed login attempts." (ACCESS DENIED.)
     Note, this approach means an actual user can be denied access for 12 hours after making 4 mistakes.
     __Login Security Solution__
     * _Invalid Credentials by Attacker or Actual User_
 ) Process authentication request (check IP, user name, and password)
 ) Slow down the response
 ) Error message: "Incorrect username or password." (ACCESS DENIED.)
     * _Valid Credentials by Attacker_
 ) Process authentication request (check IP, user name, and password)
 ) Slow down the response
 ) Set force password change flag for user
 ) Error message: "Your password must be reset. Please submit this form to reset it." (ACCESS DENIED.)
     * _Valid Credentials by Actual User_
 ) Process authentication request (check IP, user name, and password)
 ) (If user is coming from their verified IP address, let them in, END)
 ) Slow down the response
 ) Error message: "Your password must be reset. Please submit this form to reset it." (ACCESS DENIED.)
 ) On subsequent request... user verifies their identity via password reset process
 ) User's IP address is added to their verified IP list for future reference
+__Limit Login Attempts__
+* _Invalid or Valid Credentials by Attacker or Actual User_
+) Process authentication request (check IP address)
+) Error message: "Too many failed login attempts." (ACCESS DENIED.)
+Note, this approach means an actual user can be denied access for 12 hours after making 4 mistakes.
+__Login Security Solution__
+* _Invalid Credentials by Attacker or Actual User_
+) Process authentication request (check IP, user name, and password)
+) Slow down the response
+) Error message: "Incorrect username or password." (ACCESS DENIED.)
+* _Valid Credentials by Attacker_
+) Process authentication request (check IP, user name, and password)
+) Slow down the response
+) Set force password change flag for user
+) Error message: "Your password must be reset. Please submit this form to reset it." (ACCESS DENIED.)
+* _Valid Credentials by Actual User_
+) Process authentication request (check IP, user name, and password)
+) (If user is coming from their verified IP address, let them in, END)
+) Slow down the response
+) Error message: "Your password must be reset. Please submit this form to reset it." (ACCESS DENIED.)
+) On subsequent request... user verifies their identity via password reset process
+) User's IP address is added to their verified IP list for future reference
 So both plugins deny access to attackers. But Login Security Solution has

Note: See TracChangeset for help on using the changeset viewer.

Trac UI Preferences

Plugin Directory

Context Navigation

Changeset 607721

Legend:

login-security-solution/trunk/readme.txt

Download in other formats: