Limiting the Number of User Login Attempts for SSH Sessions
A remote administrator may login to a device through SSH. Administrator credentials are stored
locally on the device. If the remote administrator presents a valid username and
password, access to the TOE is granted. If the credentials are invalid, the TOE allows
the authentication to be retried after an interval that starts after 1 second and
increases exponentially. If the number of authentication attempts exceed the configured
maximum, no authentication attempts are accepted until the
administrator has unlocked the account. When the account has been unlocked, remote
authentication attempts using that account are again accepted. The unlocking of the
account takes place using the following command:clear system login lockout
user <user>.
You can configure the device to limit the number of attempts to enter a password while logging through SSH. Using the following command, the connection can be terminated if a user fails to login after a specified number of attempts:
The number of reattempts the device allows is defined by the
tries-before-disconnect option. The device allows 3 unsuccessful
attempts by default or as configured by the administrator. The
device prevents the locked users to perform activities that require authentication,
until a security administrator unlocks the account from console. However, the
existing locks are ignored when the user attempts to log in from the local
console
[edit system login] user@host# set retry-options tries-before-disconnect <number>
Here, tries-before-disconnect is the number of times
a user can attempt to enter a password when logging in. The connection
closes if a user fails to log in after the number specified. The range
is from 1 through 10, and the default value is 10.
You can also configure a delay, before a user can try to enter a password after a failed attempt.
[edit system login] user@host# set retry-options backoff-threshold <number>
Here, backoff-threshold is the threshold for the
number of failed login attempts before the user experiences a delay
in being able to enter a password again. The range is from 1 through
3, and the default value is 2 seconds. Use the backoff-factor option to specify the length of the delay in seconds.
In addition, the device can be configured to specify the threshold for the number of failed attempts before the user experiences a delay in entering the password again.
[edit system login] user@host# set retry-options backoff-factor <number>
Here, backoff-factor is the length of time, in seconds,
before a user can attempt to log in after a failed attempt. The delay
increases by the value specified for each subsequent attempt after
the threshold. The range is from 5 through 10, and the default value
is 5 seconds.