1

I have a client who has found that when one user is locked out of the CP, all others are locked out too. This makes me think that this is based on IP address alone rather than username.

Anybody got any experience with this issue?

Thanks

EDIT IN RESPONSE TO QUESTIONS:

This happened over a weekend so I wasn't online to check the database at the time. However the message received was 'You are only permitted to make four login attempts every 30 minute(s)'. So one user locked triggered this lockout but it affected all other users in his company.

Looking at the check_password_lockout() method in Session.php it looks like the check is based on username OR useragent. So it would appear that if he locked himself out in a particular browser, all other users on that IP would be locked out if they were using the same browser.

I'm not a security expert in any way, but shouldn't that SQL check be AND not OR? Any thoughts?

Improve this question
2
  • Can you provide the exact text of the message the users receive?
    – Isaac Raway
    Commented Dec 1, 2012 at 21:04
  • How long are the blocks active and can you find them in the database.
    – Kim Wickell
    Commented Dec 2, 2012 at 0:28

2 Answers 2

Reset to default
4

It's normal that EE restricts logins based on IP address. Restricting on user agent wouldn't be much use, because a malicious script could just change the user agent for every request.

That said, the normal EE error message is You are only permitted to make four login attempts every 1 minute(s). You must have increased this from 1 minute to 30 minutes, which is clearly unusable.

In the control panel, go to Admin > Security & Privacy > Security and Sessions.

There, you will find the setting: Time Interval for Lockout

Set this back to 1, or if that is still too long for you, even 0.5.

After changing this session, you probably also want to empty the exp_password_lockout table to remove any lockouts currently in effect.

Improve this answer
1
  • Thanks Adrian. Where you say 'Restricting on user agent wouldn't be much use', this is what EE appears to be doing in its core check_password_lockout() method. Sounds like this would be one to query with Ellislab for a change.
    – Russ Back
    Commented Dec 4, 2012 at 10:41
3

Locked out how? After too many attempts to login or actually blocked because of malicious activity?

If you're blacklisted this is done based on your IP, so that would cause other people on the same network to be blocked too.

– Wouter

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.