msp/userlockout

Brute force prevention system for Magento2 - Member of MageSpecialist SecuritySuite

1.1.1 2017-09-07 16:09 UTC

Requires

• php: ^7.0|^7.1
• magento/magento-composer-installer: *
• msp/security-suite-common: >=1.3

Suggests

• msp/security-suite: Full MageSpecialist Security Suite

OSL 3.0

• Riccardo Tempesta

README

Customer login brute force protection module.

This module can temporary lock a customer account when too many login password attempts fail are detected.

Member of MSP Security Suite

See: https://github.com/magespecialist/m2-MSP_Security_Suite

Installing on Magento2:

1. Install using composer

From command line:

composer require msp/userlockout
php bin/magento setup:upgrade

2. Enable and configure from your Magento backend config

Frontend screenshot

When the amount of failed attempts is reached, this module prevents further attemps for a defined amount of seconds.

This is one of the most effective countermeasures for brute force.

Backend manual unlock

You can monitor and manually unlock users from your Magento backend under Customers > Locked Users:

Command-line unlock

You can manually unlock one user from command-line if necessary:

php bin/magento msp:security:lockout:unlock <IP> <username>

Example:

php bin/magento msp:security:lockout:unlock 127.0.0.1 [e-mail]