Set max no. of invalid attempts - Authentication Providers [Lead: Mike Horton]

Forum DotNetNuke® Pro... Authentication ... Set max no. of invalid attempts

7/28/2008 9:39 PM

	Sham
8 posts

Set max no. of invalid attempts

Hai everyone,

This month my website is pretty much under constant attack i dont know why, so i hire someone to perform penetration test on my portal. From their result a lot of think i must do, the minor part i must change max no of invalid attempts. I check from web.config the default no of invalid attempt is 5 . Anyway, to remove DNN from the issue, how would I make DNN block an IP from trying a login attempt x amount of times? I want to set a maximum attempt count to like 3 or something before I get hacked.

Thanks a million !

7/28/2008 10:18 PM

	Mike Horton
3163 posts
dnn.gmss.org

Re: Set max no. of invalid attempts

I could be wrong but I don't think you can block an IP from visiting the site from within DNN. That's usually something that's handled in IIS itself.

7/30/2008 7:04 PM

	Sham
8 posts

Re: Set max no. of invalid attempts

Hi,

Sorry for late reply, i pass this problem to my security officer. So he suggest to apply SSL cert on our portal and also enable redirection from HTTP to HTTPS. But for my side, i still need to set up the max number of invalid attempts = 3. Can you help me to solve this problem. Thanks.

Regards,

Sham

7/30/2008 11:48 PM

	Mike Horton
3163 posts
dnn.gmss.org

Re: Set max no. of invalid attempts

Not from an IP I can't as that's done in IIS like I mentioned above but from a user you just need to add that to the appropriate line in your web.config. Search your web.config for passwordAttemptThreshold=int and put that in the line right below that commented section (if it's not there already) and set the int to 3 so that it looks like passwordAttemptThreshold=3;

Page 1 of 1

Forum

DotNetNuke® Pro...

Authentication ...

Set max no. of invalid attempts