Secure passwords of CMS Console user accounts against dictionary attacks

By default, the user can try logging in to the CMS Console an unlimited number of times in C1 CMS.

You can however limit the number of failed login attempts:

1. Edit ~/App_Data/Composite/Composite.config.
2. Locate this configuration element:
   

   <Composite.C1Console.Security.Plugins.LoginProviderConfiguration 
       defaultLoginProviderPlugin="DataBasedFormLoginProvider">

3. Add an attribute " maxLoginAttempts" setting its value to the maximum number of attempts you would like to limit CMS Console logins with, for example:

   <Composite.C1Console.Security.Plugins.LoginProviderConfiguration 
       defaultLoginProviderPlugin="DataBasedFormLoginProvider" 
       maxLoginAttempts="100">

4. Save the file.

Now the user who exceeds the maximum number of login attempts will get locked out. When she or he tries to log in with the correct password, a message pops up: "The account was locked after maximum login attempts. Please contact administrator."

The administrator can unlock such a user account:

1. Log in to the CMS Console with administrative permissions.
2. In the "System" perspective expand "Users and Permissions" / "Users" / (a folder the user account is in, if any).
3. Locate and edit the locked out user. (Normally, the locked out user account has a different (grayed) icon.)
4. Uncheck the "Is Locked" option.
5. Save the changes.

Now the user can log in with her or his correct password.

Requirements

C1 CMS version 4.3 or later