Page History

A brute-force attack is well known factor as a major security threat to servers. The attackers generally involve in which an unauthorized user attempts to log into a system. Generally this involves an automated software program that checks for trying all possible login passwords and pass phrases passphrases by trial and error until the correct password is found. Alternatively, the attacker attempts to guess the key, which is typically created from the password using a key derivation function.

To defend against brute-force attacks to this type of attack, the BMC , limits the number of unsuccessful login attempts allowed is to four. After four invalid attempts, the a user account is automatically disabled by default for both SSH and Web web UI logins to the BMC. Note that the number of unsuccessful login attempts equals is the sum of both SSH and WEB UI login attempts. For example, If after two unsuccessful SSH attempts are made from SSH and two from the WEB web UI, the a user account is locked by the server. This action is also recorded in an appropriate event log. The server automatically unlocks the user account after 60 seconds, whereby allowing a user can reattempt to login to to reattempt logging into the BMC.

To know more about Brute Force Password Guessing, refer Refer to Managing SBC Core Users and Accounts for more information on user account security measures.

Follow these steps to know the defend against the Brute Force Password Guessing attemptsdemonstrate the user lockout that guards against brute-force password guessing:

1. Access the SBC BMC GUI using a web browser. The BMC login screen is displayed.

   Caption
   0 Figure 1 SBC BMC Login Screen

2. Enter the wrong username and password for the same username four consecutive attemptstimes. The User gets user account is locked and a lockout message is displayed stating "User Is Locked, Please Try After 60 sec", as shown in the following figure.

   Caption
   0 Figure 1 Brute Force Password Guessing - Locked User

3. Refresh After 60 seconds have elapsed, refresh the browser after 60 seconds. The login page re-appears for inputsand accepts input.