Refactor #22778
closed
Allow admin to opt-out from the Brute-force attack protection
Added by roman plevka almost 7 years ago.
Updated about 6 years ago.
Description
Implementation of http://projects.theforeman.org/issues/4238 introduced a BFA protection, however this is not configurable at all (enable/disable, number of retries, blacklist timeout, etc.).
It would be beneficial, if I as an admin had a way of configure or completely disable the feature.
- e.g. our automation, running on a single foreman instance executes multiple tests, one of them being a negative tests trying an invalid authentication - this test typically lock the automation out from Foreman access, causing all further tests to fail.
Please consider adding this RFE as its absence right now blocks QE's automation.
Interesting problem. I see we count to 30 if the login attempt fails. Does that mean that automation tried 30 times wrong password? Is that a single test that does that? Or what does the automation try to achieve? A workaround might be cleaning Rails cache, which is normally located at /usr/share/foreman/tmp/. Or you can try running foreman-rake tmp:clear
- Related to Feature #4238: Protection from Brute Force Password Attacks added
- Status changed from New to Ready For Testing
- Assignee set to Marek Hulán
- Pull request https://github.com/theforeman/foreman/pull/5619 added
- Translation missing: en.field_release set to 353
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
- Triaged set to No
- Bugzilla link set to 1633360
Also available in: Atom
PDF