Set max no. of invalid attempts - Authentication

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

Home All Forums

1
2
3
4
5

Home

DNN Open Source...

Provider and Extension Forums

Authentication

Set max no. of invalid attempts

7/28/2008 11:39 PM

Nur Hishamudin Tarudin

Joined: 7/10/2007

Posts: 13

Set max no. of invalid attempts

Hai everyone,

This month my website is pretty much under constant attack i dont know why, so i hire someone to perform penetration test on my portal. From their result a lot of think i must do, the minor part i must change max no of invalid attempts. I check from web.config the default no of invalid attempt is 5 . Anyway, to remove DNN from the issue, how would I make DNN block an IP from trying a login attempt x amount of times? I want to set a maximum attempt count to like 3 or something before I get hacked.

Thanks a million !

7/29/2008 12:18 AM

Mike Horton

Joined: 7/16/2003

Posts: 4865

Re: Set max no. of invalid attempts

I could be wrong but I don't think you can block an IP from visiting the site from within DNN. That's usually something that's handled in IIS itself.

7/30/2008 9:04 PM

Nur Hishamudin Tarudin

Joined: 7/10/2007

Posts: 13

Re: Set max no. of invalid attempts

Hi,

Sorry for late reply, i pass this problem to my security officer. So he suggest to apply SSL cert on our portal and also enable redirection from HTTP to HTTPS. But for my side, i still need to set up the max number of invalid attempts = 3. Can you help me to solve this problem. Thanks.

Regards,

Sham

7/31/2008 1:48 AM

Mike Horton

Joined: 7/16/2003

Posts: 4865

Re: Set max no. of invalid attempts

Not from an IP I can't as that's done in IIS like I mentioned above but from a user you just need to add that to the appropriate line in your web.config. Search your web.config for passwordAttemptThreshold=int and put that in the line right below that commented section (if it's not there already) and set the int to 3 so that it looks like passwordAttemptThreshold=3;

Page 1 of 1

Home

DNN Open Source...

Provider and Extension Forums

Authentication

Set max no. of invalid attempts

These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
No Flaming or Trolling.
No Profanity, Racism, or Prejudice.
Site Moderators have the final word on approving / removing a thread or post or comment.
English language posting only, please.

Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

DNN Corp. (DotNetNuke)