Page 1 of 1

(Big) problems for the authentication

Posted: Wed Sep 21, 2016 11:17 am
by topoldo
Hello to all!
My configuration is this:
HESK Version: 2.6.8
Mods for HESK Version: 2.6.4
PHP Version: 5.3.10-1ubuntu3.24 (MySQLi)
MySQL Version: 5.5.52-0ubuntu0.12.04.1
Firefox for Windows 48.0.2 (as a client)

I am testing Mods for Hesk + Hesk vs Hesk alone for our department.
One of my tests was the following: I created the (super) administrator and one staff user.
I wanted to test the possibility to re-enter as user after I forgot my password.
When I tested this procedure with Hesk alone, I had no problems.
On the contrary, when I tried the same experiment by using Mods for Hesk + Hesk I have a very strange result.
The experiment was the following:
- As a user I put a wrong password for 3 times (I set a maximum of 5 attempt)
- At this point I asked the 'help", ie I told to the system that "I forgot my password"
- The Recaptcha2 wante to check that "I'm not a robot'.
- Immediately after my answer, the system told me that I was sent out of the system for 60 min (the time I set in the options) because of "too many attempt failed" :shock:
- At this point, from the same computer and the same browser (without closing it) I tried to access as administrator.
Unfortunately even if as administrator I submit the correct password, I was immediately kept out exactly as the previous user :shock: :shock:
- At this point I opened anothe browser (Google Chrome) to retry to enter as administrator, but also in this case I was kept out because of: "too many attempt failed"
Am I wrong somehow?
Did anyone experienced similar problems?
TIA,
Topoldo

Re: (Big) problems for the authentication

Posted: Thu Sep 22, 2016 6:35 am
by Klemen
Just a note:

I am not sure how Mods for Hesk handles brute force checks, but once you get blocked for 60 minutes changing the browser won't help.

Blocking is done by IP address so you will need to either change the IP address you use to connect to Hesk or manually unblock your IP.

Re: (Big) problems for the authentication

Posted: Thu Sep 22, 2016 8:27 am
by topoldo
I solved my question: for some strange reasons the table hesk_users disappeared :(
Topoldo