Version 1.4.015.06.2026
Stabilitäts- und Kompatibilitätsupdate.
Paket herunterladen← Zurück zu Apps
ApprovedSecurity
Brute-Force Protection
Prevent attackers from guessing user passwords
von Semih Serhat Karakaya, modified by BW-Tech GmbHÜber diese App
A brute-force attack occurs when an attacker uses a range of potential passwords in the hope of using the correct one and gaining access to a user's account. Such attacks frequently operate in an automated manner. Doing so lets attackers try many different password combinations in a small time frame.
Additionally, attackers may use password dictionaries to reduce the number of potential combinations to actual words. This kind of attack is called a "dictionary attack". Depending on the strength of a password, attackers can estimate the number of attempts, and the respective time required to break the password and gain access to a user's account. Administrators should be aware of this potential threat and take appropriate counter-measures.
That's why the Brute-Force Protection extension was developed. It allows administrators to specify a maximum number of unsuccessful user account login attempts. On reaching the unsuccessful login limit, ownCloud temporarily bans further login attempts to those user accounts from the originating IP address. The time frame of the ban is configurable by ownCloud administrators.
Once a ban is in effect, an attacker is forced to either change their IP address or wait for the ban time to expire before continuing the attack. This best-practice approach increases the amount of time required to conduct an attack, drastically reducing the feasibility of the attack and the possibility of a successful account login.
Also, ownCloud administrators can take further steps to increase user account security. These include:
1. Requiring strong passwords, using the Password Policy extension.
2. Enabling two- or multi-factor authentication (e.g., a time-based one-time password), which can, theoretically, make brute-force attacks impossible.
See the 2-Factor Authentication extension, more sophisticated MFA solutions or outsourcing user authentication to an Identity Provider via the SAML/SSO Integration for further information.
This is a PHP 8.4 fork maintained by BW-Tech GmbH for owncloud.online.
Additionally, attackers may use password dictionaries to reduce the number of potential combinations to actual words. This kind of attack is called a "dictionary attack". Depending on the strength of a password, attackers can estimate the number of attempts, and the respective time required to break the password and gain access to a user's account. Administrators should be aware of this potential threat and take appropriate counter-measures.
That's why the Brute-Force Protection extension was developed. It allows administrators to specify a maximum number of unsuccessful user account login attempts. On reaching the unsuccessful login limit, ownCloud temporarily bans further login attempts to those user accounts from the originating IP address. The time frame of the ban is configurable by ownCloud administrators.
Once a ban is in effect, an attacker is forced to either change their IP address or wait for the ban time to expire before continuing the attack. This best-practice approach increases the amount of time required to conduct an attack, drastically reducing the feasibility of the attack and the possibility of a successful account login.
Also, ownCloud administrators can take further steps to increase user account security. These include:
1. Requiring strong passwords, using the Password Policy extension.
2. Enabling two- or multi-factor authentication (e.g., a time-based one-time password), which can, theoretically, make brute-force attacks impossible.
See the 2-Factor Authentication extension, more sophisticated MFA solutions or outsourcing user authentication to an Identity Provider via the SAML/SSO Integration for further information.
This is a PHP 8.4 fork maintained by BW-Tech GmbH for owncloud.online.
Screenshots
