Handling brute force attacks with Umbraco

If we want our Umbraco website to block users in case there is a brute force attack for an id we can do this:

Add 2 properties to your member type: locked [true, false] and failedLogins [Numeric].

Add the following properties to your UmbracoMembershipProvider key inside webcofig (notice the values are the same as the aliases of the properties we just created):

umbracoLockPropertyTypeAlias=”locked”

umbracoFailedPasswordAttemptsPropertyTypeAlias=”failedLogins”

maxInvalidPasswordAttempts=”3″

passwordAttemptWindow=”30″

Your webconfig should look something like this:

<add name="UmbracoMembershipProvider"
type="umbraco.providers.members.UmbracoMembershipProvider"
enablePasswordRetrieval="false"
enablePasswordReset="false"
requiresQuestionAndAnswer="false"
defaultMemberTypeAlias="MyMemberType"
passwordFormat="Hashed"
umbracoLockPropertyTypeAlias="locked"
umbracoFailedPasswordAttemptsPropertyTypeAlias="failedLogins"
maxInvalidPasswordAttempts="3"
passwordAttemptWindow="30"
/>

The rest is handled by Umbraco. You also have a couple of properties to set how many times before a block and how much time the user is blocked. You can use the property defaultMemberTypeAlias to set your memberType alias in case you find any problem.

To unlock a member you need to access the admin panel > members > member: uncheck the checkbox “Blocked” and set “Failed logins” to 0.

Source | More info