Raynet One Data Hub supports automatic account lockout to protect against brute-force attacks. When enabled, a user account is temporarily locked after a configurable number of consecutive failed login attempts. Locked accounts cannot be used to sign in until the lockout period expires or an administrator manually unlocks the account.
Configuring Account Lockout
Account lockout settings are system-wide and are configured by Site Administrators in the System Settings. To open the settings, navigate to Site Administration > System Settings and click Edit.
The following settings are available in the Account Lockout section:
Setting |
Default Value |
Description |
|---|---|---|
Enable Account Lockout |
Disabled |
Enables or disables the account lockout feature. When disabled, login attempts are never restricted regardless of the number of failures. |
Maximum failed login attempts |
6 |
The number of consecutive failed login attempts that triggers a lockout. Accepts values between 1 and 100. This setting is only available when account lockout is enabled. |
Lockout duration (minutes) |
30 |
The duration in minutes for which an account remains locked after exceeding the failed attempt limit. Accepted values range from 1 to 525,600 minutes (equivalent to 1 year). The account is automatically unlocked when this period expires. This setting is only available when account lockout is enabled. |
Show account locked message on login |
Disabled |
When enabled, users see a specific message indicating that their account is locked. When disabled, the generic invalid credentials message is shown instead. This setting is only available when account lockout is enabled. |
|
Security Note: Enabling the Show account locked message option may reveal the existence of valid account names to potential attackers, as a distinct message differentiates a locked account from an account that simply does not exist. It is recommended to leave this option disabled in high-security environments. |
Identifying Locked Accounts
When account lockout is enabled, locked accounts are visually indicated in the user lists. A lock icon is displayed next to the username of any currently locked account in both the Users page (for tenant administrators) and the All Users page (for Site Administrators). Hovering over the lock icon displays a tooltip showing the date and time until which the account is locked.
Unlocking Accounts Manually
Administrators can manually unlock a locked account before the lockout period expires. Unlocking an account immediately restores the user's ability to sign in. The failed login attempt counter is reset upon unlocking.
There are two ways to unlock an account:
From the Users or All Users List
This method allows an administrator to unlock accounts directly from the user list without opening the individual user profile.
1.Navigate to Administration > Users (tenant administrators) or Site Administration > All Users (Site Administrators).
2.Locate the locked user in the list. The user's name is shown with a red lock icon.
3.Click the lock icon next to the username. A confirmation dialog opens.
4.Confirm the unlock by clicking Unlock in the dialog. The account is unlocked immediately.
From the User Profile
Accounts can also be unlocked from within the individual user profile.
1.Navigate to Administration > Users or Site Administration > All Users.
2.Click the username of the locked user to open the user profile.
3.The profile displays an account locked notice including the date and time until which the account is locked.
4.Click the Click here to unlock link. A confirmation dialog opens.
5.Confirm the unlock by clicking Unlock in the dialog. The account is unlocked immediately.
Security Logging for Automatic Unlock
When security logging is enabled in the System Settings, a security log entry is written whenever an account is automatically unlocked after its lockout period expires. The automatic unlock takes effect the next time the user signs in successfully after the lockout period has passed.
The security log entry for an automatic account unlock contains the following information:
•User ID: The internal identifier of the account that was automatically unlocked.
•Username: The username of the account that was automatically unlocked.
The entry is recorded in the dedicated security log file. For more information, see the Enable Security Logging setting in System Settings.
Multi-Tenant Considerations
The account lockout settings are configured system-wide and apply equally to all tenants in the Raynet One Data Hub instance. It is not possible to define different lockout thresholds or durations per tenant through the System Settings.
If individual tenants require different account lockout configurations, consider managing authentication through LDAP. LDAP allows per-tenant authentication policies to be defined externally, giving each tenant its own set of security constraints independent of the system-wide settings. For more information, see LDAP Configuration and Usage.
See Also