nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Aborting logon after 5 failed attempts

carey

Has anybody tried configuring the login page for Teamsite 6.5 to abort the logon process after a pre-determine number of failed attempts? If so, would you be willing to share how you did it?

Our IT security group considers this a security problem because without the above functionality somebody can do a "brute force" password attack.

Find more posts tagged with

Comments

kaalraa

Only thing to suggest is to create your own cgi file as per the login page and checks for the username / password for the number of times you want to allow.

Has anybody tried configuring the login page for Teamsite 6.5 to abort the logon process after a pre-determine number of failed attempts? If so, would you be willing to share how you did it?

Our IT security group considers this a security problem because without the above functionality somebody can do a "brute force" password attack.

stefanmaier

On which OS did you install TS?
Which system are you using for managing your user accounts?
Often backend systems (like the Active Directory Service in the windows world) are counting login attempts.
We use this ADS functionality to secure our windows world. If somebody tries to logon on our TS server three times,
the windows account is locked for 30 minutes...

ravio

Only thing to suggest is to create your own cgi file as per the login page and checks for the username / password for the number of times you want to allow.

This solution is very much workable and we had done something similar in one of the projects earlier, however on done_page we were redirecting the browser to a custom application GUI and not into TeamSite.

However, in this particular case, the complication is that
1. The users should know of only of the starting URL as provided and use only that for login
2. There is still nothing to prevent the user from accessing the actual TS login URL by pasting it into browser
3. If the IWAUTH cookie has been deleted or has expired, the users are going to get the TS login screen and not the custom login CGI

I think this will make a good FR (Feature Request) to file with IWOV

carey

On which OS did you install TS?
Which system are you using for managing your user accounts?
Often backend systems (like the Active Directory Service in the windows world) are counting login attempts.
We use this ADS functionality to secure our windows world. If somebody tries to logon on our TS server three times,
the windows account is locked for 30 minutes...

We are on Solaris 9 and user management is done with the standard OS level authentication - passwd and shadow files. The authentication process does count login attempts, but accessing Teamsite via the web interface isn't considered the same as opening a shell on the server itself.

What I have been told is that Teamsite just authenticates against the OS. It doesn't login, so it doesn't recognize any login policies that the OS might have including password expiration, login attempts, etc.

carey

I think this will make a good FR (Feature Request) to file with IWOV

No kidding. However, to me it is sad that they haven't thought of this themselves. This really is a security hole.

Thanks for everybody's input.

two_column.rptdesign