User auth limits.pl - Revision history

Drn@ecs.soton.ac.uk: Added previous user_password_maxlength.pl config into this config file.

2022-01-31T08:40:51Z

Added previous user_password_maxlength.pl config into this config file.

← Older revision		Revision as of 08:40, 31 January 2022
Line 8:		Line 8:
	* '''<code>$c->{max_account_requests}</code>''' - Maximum number of accounts tht can be requested in a set period. Default is 100.		* '''<code>$c->{max_account_requests}</code>''' - Maximum number of accounts tht can be requested in a set period. Default is 100.
	* '''<code>$c->{max_account_requests_minutes}</code>''' - Number of minutes for which no more than the <code>max_account_requests</code> can be requested. Default is 60 minutes.		* '''<code>$c->{max_account_requests_minutes}</code>''' - Number of minutes for which no more than the <code>max_account_requests</code> can be requested. Default is 60 minutes.
			* '''<code>$c->{password_maxlength}</code>''' - The maximum number of characters that a password can have. Default is 200 characters. This is required to prevent malicious users typing in millions of characters for passwords and then trying to denial-of-service the repository whilst it try to hash them.

			This file also contain an '''<code>EP_TRIGGER_VALIDATE_FIELD</code>''' trigger to test any [[API:EPrints/MetaField/Secret\|secret]] fields (likely to be password fields) are not trying to set a password longer than <code>$c->{password_maxlength}</code>.

	[[Category:Authentication]]		[[Category:Authentication]]

Drn@ecs.soton.ac.uk: Added authentication category

2022-01-31T08:17:20Z

Added authentication category

← Older revision		Revision as of 08:17, 31 January 2022
Line 8:		Line 8:
	* '''<code>$c->{max_account_requests}</code>''' - Maximum number of accounts tht can be requested in a set period. Default is 100.		* '''<code>$c->{max_account_requests}</code>''' - Maximum number of accounts tht can be requested in a set period. Default is 100.
	* '''<code>$c->{max_account_requests_minutes}</code>''' - Number of minutes for which no more than the <code>max_account_requests</code> can be requested. Default is 60 minutes.		* '''<code>$c->{max_account_requests_minutes}</code>''' - Number of minutes for which no more than the <code>max_account_requests</code> can be requested. Default is 60 minutes.

			[[Category:Authentication]]

Drn@ecs.soton.ac.uk at 00:00, 31 January 2022

2022-01-31T00:00:34Z

← Older revision		Revision as of 00:00, 31 January 2022
Line 3:		Line 3:

	'''user_auth_limits.pl''' contains configuration that places limits on aspects of user authentication. It contains the following configuration options:		'''user_auth_limits.pl''' contains configuration that places limits on aspects of user authentication. It contains the following configuration options:
	* '''<code>max_login_attempts</code>''' - Maximum number of failed login attempts before the account is locked. Default is 10.		* '''<code>$c->{max_login_attempts?</code>''' - Maximum number of failed login attempts before the account is locked. Default is 10.
	* '''<code>lockout_minutes</code>''' - How long an account is locked if there are too many failed login attempts. Default is 10 minutes.		* '''<code>$c->{lockout_minutes}</code>''' - How long an account is locked if there are too many failed login attempts. Default is 10 minutes.
	* '''<code>reset_request_recent_hours</code>''' - Number of hours before another password request email can be sent. Assuming the password was not reset by the previous email. This prevents users being incessantly spammed by unsolicited password reset emails. Default is 24 hours.		* '''<code>$c->{reset_request_recent_hours}</code>''' - Number of hours before another password request email can be sent. Assuming the password was not reset by the previous email. This prevents users being incessantly spammed by unsolicited password reset emails. Default is 24 hours.
	* '''<code>max_account_requests</code>''' - Maximum number of accounts tht can be requested in a set period. Default is 100.		* '''<code>$c->{max_account_requests}</code>''' - Maximum number of accounts tht can be requested in a set period. Default is 100.
	* '''<code>max_account_requests_minutes</code>''' - Number of minutes for which no more than the <code>max_account_requests</code> can be requested. Default is 60 minutes.		* '''<code>$c->{max_account_requests_minutes}</code>''' - Number of minutes for which no more than the <code>max_account_requests</code> can be requested. Default is 60 minutes.

Drn@ecs.soton.ac.uk: Added page about config file

2022-01-30T23:59:52Z

Added page about config file

New page

{{dirs}}
{{cfgd}}

'''user_auth_limits.pl''' contains configuration that places limits on aspects of user authentication. It contains the following configuration options:
* '''<code>max_login_attempts</code>''' - Maximum number of failed login attempts before the account is locked. Default is 10.
* '''<code>lockout_minutes</code>''' - How long an account is locked if there are too many failed login attempts. Default is 10 minutes.
* '''<code>reset_request_recent_hours</code>''' - Number of hours before another password request email can be sent. Assuming the password was not reset by the previous email. This prevents users being incessantly spammed by unsolicited password reset emails. Default is 24 hours.
* '''<code>max_account_requests</code>''' - Maximum number of accounts tht can be requested in a set period. Default is 100.
* '''<code>max_account_requests_minutes</code>''' - Number of minutes for which no more than the <code>max_account_requests</code> can be requested. Default is 60 minutes.