After entering the wrong password for 5 time, a user account gets locked/suspended.
How do I change this? Instead of 5, I need the accounts are blocked after 10 tentatives.
I already seen the Flood Unblock module, but it unblocks the already blocked users who entered the wrong password more than 5 times.
This is a configuration setting. You can run the drush command:
drush cset user.flood user_limit 10
Drupal uses code similar to the following one, to check if the user entered the wrong password too much times.
// Don't allow login if the limit for this user has been reached.
// Default is to allow 5 failed attempts every 6 hours.
if (!$this->flood->isAllowed('user.failed_login_user', $flood_config->get('user_limit'), $flood_config->get('user_window'), $identifier)) {
$form_state->set('flood_control_triggered', 'user');
return;
}
$flood_config is initialized with the following code.
$flood_config = $this->config('user.flood');
The value you need to change is user_limit; user_window is the time (in seconds) after which the number of attempts is reset. (The default values are reported in the code comment.)
Since those values aren't exposed in an administrative settings page, you can use code similar to the following to alter them.
$config = \Drupal::service('config.factory')->getEditable('user.flood');
$config->set('user_window', 10)->save();
Similarly, you could alter the user_window value, which is the time expressed in seconds.
Note that Drupal core has also a limit for the attempts to log in from the same IP, which is checked from the user login form.
// Do not allow any login from the current user's IP if the limit has been
// reached. Default is 50 failed attempts allowed in one hour. This is
// independent of the per-user limit to catch attempts from one IP to log
// in to many different user accounts. We have a reasonably high limit
// since there may be only one apparent IP for all users at an institution.
if (!$this->flood->isAllowed('user.failed_login_ip', $flood_config->get('ip_limit'), $flood_config->get('ip_window'))) {
$form_state->set('flood_control_triggered', 'ip');
return;
}
As the code comment says, by default 50 failed attempts are allowed in one hour.
That value needs to be considered, since when the value of user_limit is set higher than the ip_limit value, it's the latter value that is used. Since a module could change the value for ip_limit, even change it to a value lower than user_limit, I would check the value for ip_limit and eventually correct it.
