Marcus Efraimsson 3d1c624c12 WIP: Protect against brute force (frequent) login attempts (#10031) ... * db: add login attempt migrations * db: add possibility to create login attempts * db: add possibility to retrieve login attempt count per username * auth: validation and update of login attempts for invalid credentials If login attempt count for user authenticating is 5 or more the last 5 minutes we temporarily block the user access to login * db: add possibility to delete expired login attempts * cleanup: Delete login attempts older than 10 minutes The cleanup job are running continuously and triggering each 10 minute * fix typo: rename consequent to consequent * auth: enable login attempt validation for ldap logins * auth: disable login attempts validation by configuration Setting is named DisableLoginAttemptsValidation and is false by default Config disable_login_attempts_validation is placed under security section #7616 * auth: don't run cleanup of login attempts if feature is disabled #7616 * auth: rename settings.go to ldap_settings.go * auth: refactor AuthenticateUser Extract grafana login, ldap login and login attemp validation together with their tests to separate files. Enables testing of many more aspects when authenticating a user. #7616 * auth: rename login attempt validation to brute force login protection Setting DisableLoginAttemptsValidation => DisableBruteForceLoginProtection Configuration disable_login_attempts_validation => disable_brute_force_login_protection #7616		2018-01-26 10:41:41 +01:00
..
setting_oauth.go	Always verify TLS unless explicitly told otherwise	2017-10-06 17:09:27 +01:00
setting_quota.go	move toMap function to be a method on the quota structs	2015-09-15 17:18:26 +08:00
setting_smtp.go	introduce smtp config option for EHLO identity	2017-09-24 20:48:20 +02:00
setting_test.go	setting: add tests for windows	2017-06-28 09:35:33 +02:00
setting.go	WIP: Protect against brute force (frequent) login attempts (#10031)	2018-01-26 10:41:41 +01:00