From ba4f12baa02dfb55ec8822687896d643261440c4 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Wed, 20 Jul 2016 18:36:15 +0200 Subject: Implement brute force protection Class Throttler implements the bruteforce protection for security actions in Nextcloud. It is working by logging invalid login attempts to the database and slowing down all login attempts from the same subnet. The max delay is 30 seconds and the starting delay are 200 milliseconds. (after the first failed login) --- config/config.sample.php | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'config') diff --git a/config/config.sample.php b/config/config.sample.php index 051e5422fe5..c9f5fecf5f9 100644 --- a/config/config.sample.php +++ b/config/config.sample.php @@ -207,6 +207,13 @@ $CONFIG = array( */ 'token_auth_enforced' => false, +/** + * Whether the bruteforce protection shipped with Nextcloud should be enabled or not. + * + * Disabling this is discouraged for security reasons. + */ +'auth.bruteforce.protection.enabled' => true, + /** * The directory where the skeleton files are located. These files will be * copied to the data directory of new users. Leave empty to not copy any -- cgit v1.2.3