dotnetnuke security - New to DNN Platform

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

Home All Forums

1
2
3
4
5

4/16/2011 8:46 PM

uanmi

Joined: 9/28/2006

Posts: 69

dotnetnuke security

Hi, I would like to know how dotnetnuke can be used to implement the following: (1) a user attempts to login three times incorrectly and gets a 30 minute time-out, (2) alert messages are sent to the administrator account, and (3) an easier way to reset the administrator and host password using the sql server if the accounts are locked out due to a hacker password attack

This is very important due to the number of website security attacks happening now.

regards,

Mark

4/17/2011 5:00 AM

Sebastian Leupold

www.dnnwerk.de
Joined: 3/8/2004

Posts: 46212

Re: dotnetnuke security

1) you may specify password attempts and logout time in web.config for the Microsoft membership component, which is incorporated by DNN. 2) failed login attempts can be logged into the DNN event log and mailed to the admin, see event type settings (you'll need to enable the associated scheduler job as well). 3) password reset by SQL server is not supported, you should create a solution based on the business logic.

Cheers from Germany,
Sebastian Leupold

Speed up your DNN Websites with TurboDNN

5/6/2011 9:45 PM

uanmi

Joined: 9/28/2006

Posts: 69

Re: dotnetnuke security

I would appreciate advice on how to log the failed login attempts and to have the details mailed to the admin as the log event occurs.

If someone attacks the host and admin accounts and they get locked out then how can the password be reset if this cannot be done using the SQL server?

regards,

Mark

5/7/2011 5:24 AM

Sebastian Leupold

www.dnnwerk.de
Joined: 3/8/2004

Posts: 46212

Re: dotnetnuke security

AFAIR, host accounts do not get locked at all, there is a time delay only of 10 mins by default after 5 failed attempts. To setup logging and mailing, go to Event Viewer in Admin menu and select "Manage Types" (or sth. like this). Edit settings for Failed login attempts, which should be in the list.

Cheers from Germany,
Sebastian Leupold

Speed up your DNN Websites with TurboDNN

5/8/2011 7:43 AM

uanmi

Joined: 9/28/2006

Posts: 69

Re: dotnetnuke security

Thank you, found this setting. I will now try to stress my server and see what happens.

regards, Mark

Page 1 of 1

These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
No Flaming or Trolling.
No Profanity, Racism, or Prejudice.
Site Moderators have the final word on approving / removing a thread or post or comment.
English language posting only, please.

Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

DNN Corp. (DotNetNuke)