topic Re: Protecting the Mobile Access portal from password brute force in Mobile

Protecting the Mobile Access portal from password brute force

Arturxr — Wed, 03 Nov 2021 10:32:26 GMT

Is it possible to limit the number of password entry attempts on the Mobile Access portal?

For example, if a user enters an incorrect password 3 times, the user is blocked.

Re: Protecting the Mobile Access portal from password brute force

G_W_Albrecht — Wed, 03 Nov 2021 10:55:30 GMT

Yes, that is possible, see the Mobile Access R81 Administration Guide - it does, however, depend on the used authentication type.

Re: Protecting the Mobile Access portal from password brute force

Arturxr — Wed, 03 Nov 2021 10:57:13 GMT

Please tell me the number of the item, I read the admin guide and did not find it

Re: Protecting the Mobile Access portal from password brute force

G_W_Albrecht — Wed, 03 Nov 2021 11:17:49 GMT

Starting page 170 is User Authentication in Mobile Access. Here you select which kind of authentication should be used, and further steps are depending on it.

Re: Protecting the Mobile Access portal from password brute force

Arturxr — Wed, 03 Nov 2021 12:16:39 GMT

We have read, in our understanding it is used for 2-fa, we cannot organize dynamicid due to lack of resources, we are interested in the issue of blocking MAB users after entering the password incorrectly more than 3 times. Is there such functionality.

Re: Protecting the Mobile Access portal from password brute force

G_W_Albrecht — Wed, 03 Nov 2021 12:30:10 GMT

Not for Legacy Auth with User/Password.

Re: Protecting the Mobile Access portal from password brute force

Arturxr — Wed, 03 Nov 2021 12:33:18 GMT

it turns out that there is no such functionality?

Re: Protecting the Mobile Access portal from password brute force

G_W_Albrecht — Wed, 03 Nov 2021 14:14:20 GMT

No - what we have is sk112454 How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher), but here we talk about more than 1000 packets per second ;- ) This can be used to prevent password brute force attacks...