Feature #19987: Security: Backend user should be disabled after x failed log in (and the appropriate option is set in the install tool) - TYPO3 Core - TYPO3 Forge

Custom queries

12 LTS
Accessibility
Dashboard issues
Easy tasks
Extbase Issues
FAL Issues
FAL Sprint 2023
Hierarchical Issues
Issues reported for v11
JavaScript issues
JavaScript Issues (w/o Epics/Stories)
Most wanted Bugfixes
Most wanted Features
My open issues
New & Unassigned
No feedback within 90 days
Open Bugs
Open issues of 10
Page Tree Regressions after 2020-07-28
Recently modified
Regressions
Stabilization Issues
Usability or UX

Watchers (2)

Thomas Sperling
Vitali Stoller

Actions

Copy link

Feature #19987

closed

Security: Backend user should be disabled after x failed log in (and the appropriate option is set in the install tool)

Added by Vitali Stoller over 15 years ago. Updated almost 8 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Category:

Target version:

Candidate for patchlevel

Start date:

2009-02-09

Due date:

% Done:

Estimated time:

PHP Version:

5.2

Tags:

Complexity:

Sprint Focus:

Description

It's possible to attack the server and try to login as often as you want.
Backend user should be disabled after x failed log in.

This is also an Facebook etc. issue.

(issue imported from #M10388)

Related issues 2 (0 open — 2 closed)

Related to TYPO3 Core - Feature #75987: Implement request throttling/ rate limiting functionality and API

Closed

2016-04-29

Actions

Is duplicate of TYPO3 Core - Bug #21658: Secure the BE login - Auto disable the be user after a certain amount of login failure.

Closed

2009-11-24

Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by Steffen Müller over 15 years ago

Careful with that. On the other hand this opens doors to DDOS attacks, when user accounts get disabled in masses - although they have proper passwords and don't fear any attack.

A better proposal would be "Backend user should be disabled after x failed log in and the appropriate option is set in the install tool."

Actions

Copy link

Updated by Vitali Stoller over 15 years ago

"A better proposal would be "Backend user should be disabled after x failed log in and the appropriate option is set in the install tool."

That would also have been my suggestion.

Actions

Copy link

Updated by Alexander Opitz over 10 years ago

Tracker changed from Bug to Feature
Target version deleted (0)

Actions

Copy link

Updated by Wouter Wolters over 9 years ago

Status changed from New to Closed

Duplicate of #19987
Please continue there.

Actions

Copy link

Updated by Thomas Sperling over 8 years ago

Status changed from Closed to New
Target version set to 6.2.16

Why is this Ticket closed and why isn't there any core-solution for several years?
If there are options in the InstallTool there is no reason to not have this really useful feature.

EDIT: there is a feature since 6.2.14: https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-006/ similiar but not exactly the wished feature

Actions

Copy link

Updated by Riccardo De Contardi over 8 years ago

Subject changed from Security: Backend user should be disabled after x failed log in to Security: Backend user should be disabled after x failed log in (and the appropriate option is set in the install tool)
Target version changed from 6.2.16 to Candidate for patchlevel