How long does the wrong-password-too-many-times ban last?

divinity76 · September 16, 2023, 11:08am

entered the wrong password too many times and got ip banned. how long does the ban last?

sahsanu · September 16, 2023, 11:26am

Hello @divinity76,

Default bantime in fail2ban is 10 minutes… but if you get 5 bans in 1 day, you will be banned for 10 days.

Cheers,
sahsanu

eris · September 16, 2023, 1:16pm

It also counts for the 2FA if you have successfully logged in with username / password only after 7 failed attempts…

github.com

hestiacp/hestiacp/blob/75e13bd07d8d70d750de43bad31114cbdd418bac/web/login/index.php#L293


      
          						);
          						unset($output);
          						if ($return_var > 0) {
          							sleep(2);
          							$error = _("Invalid or missing 2FA token");
          							$_SESSION["login"]["username"] = $user;
          							$_SESSION["login"]["password"] = $password;
          							$v_session_id = quoteshellarg($_POST["token"]);
          							if (isset($_SESSION["failed_twofa"])) {
          								//allow a few failed attemps before start of logging.
          								if ($_SESSION["failed_twofa"] > 2) {
          									exec(
          										HESTIA_CMD .
          											"v-log-user-login " .
          											$v_user .
          											" " .
          											$v_ip .
          											" failed " .
          											$v_session_id .
          											" " .
          											$v_user_agent .