473,651 Members | 2,437 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Deny Access if password is wrong 3 times

hello!

Can anyone please tell me where can I find a script that
deny access if password is wrong 3 times

[]

CM
Jul 17 '05 #1
7 3707
Carlos Marangon wrote:
Can anyone please tell me where can I find a script that
deny access if password is wrong 3 times


Wouldn't you rather make your own?

Initialize a session variable to 0; at every access with a bad password
increment the variable and deny access when that variable is greater
than 3.
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--
Jul 17 '05 #2
I noticed that Message-ID:
<2c************ *************@p osting.google.c om> from Carlos Marangon
contained the following:
hello!

Can anyone please tell me where can I find a script that
deny access if password is wrong 3 times


For a single username and password, you can include the following at the
beginning of each page.

<?php
// Check to see if $PHP_AUTH_USER already contains info

if (!isset($GLOBAL S['PHP_AUTH_USER'])) {

// If empty, send header causing dialog box to appear

header('WWW-Authenticate: Basic realm="My Private Stuff"');
header('HTTP/1.0 401 Unauthorized');
echo 'Authorization Required.';
exit;

} else if (isset($GLOBALS['PHP_AUTH_USER'])) {

if (($GLOBALS['PHP_AUTH_USER'] != "Username") ||
($GLOBALS['PHP_AUTH_PW'] != "Password") ) {

header('WWW-Authenticate: Basic realm="My Private Stuff"');
header('HTTP/1.0 401 Unauthorized');
echo 'Authorization Required.';
exit;

} else {
echo "
<P>You're authorized!</p>
";
}
}
?>
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/
Jul 17 '05 #3
Won't work if cookie is off. You get a fresh session every time.

Uzytkownik "Pedro Graca" <he****@hotpop. com> napisal w wiadomosci
news:c1******** *****@ID-203069.news.uni-berlin.de...
Carlos Marangon wrote:
Can anyone please tell me where can I find a script that
deny access if password is wrong 3 times


Wouldn't you rather make your own?

Initialize a session variable to 0; at every access with a bad password
increment the variable and deny access when that variable is greater
than 3.
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

Jul 17 '05 #4
[top-post fixed]
"Chung Leong" <ch***********@ hotmail.com> wrote in message news:<ou******* *************@c omcast.com>...
Uzytkownik "Pedro Graca" <he****@hotpop. com> napisal w wiadomosci
news:c1******** *****@ID-203069.news.uni-berlin.de...
Carlos Marangon wrote:
Can anyone please tell me where can I find a script that
deny access if password is wrong 3 times
Wouldn't you rather make your own?

Initialize a session variable to 0; at every access with a bad password
increment the variable and deny access when that variable is greater
than 3.

Won't work if cookie is off. You get a fresh session every time.


Nope. Session will work even without cookies--ie, with transid

--
"Success is not what you achieve, but it is what you die for"
If you live in USA, please support John Edwards.
Email: rrjanbiah-at-Y!com
Jul 17 '05 #5
Carlos Marangon wrote:
Can anyone please tell me where can I find a script that
deny access if password is wrong 3 times


Not a script, but a suggested method:

Create a log file or database table to log IP, time and username of person
trying to log in. At each attempted login, read the file or database within the
last day (or hour or whatever). If the account has had 3 or more attempts to
log in within your chosen time period, deny access. That way, it's
self-healing. I.e. the user just has to wait until enough time has gone by to
log in and no administrative work is necessary to undo the block. The downside
is somebody could deny another user access by trying to log in as them
repeatedly, but you'd have their IP and could possibly track it from there. You
could add a script to deny user access from specific IP blocks/username
combinations to limit the scope of the problem.

This method is more secure than a cookie or session based system, as all the
pertinent info is saved on the server. But it's quite a bit more work.

Shawn
--
Shawn Wilson
sh***@glassgian t.com
http://www.glassgiant.com
Jul 17 '05 #6

Uzytkownik "R. Rajesh Jeba Anbiah" <ng**********@r ediffmail.com> napisal w
wiadomosci news:ab******** *************** ***@posting.goo gle.com...
Won't work if cookie is off. You get a fresh session every time.


Nope. Session will work even without cookies--ie, with transid


Would someone trying to break into the system happily supply the id? I think
not.
Jul 17 '05 #7
"Chung Leong" <ch***********@ hotmail.com> wrote in message news:<46******* *************@c omcast.com>...
Uzytkownik "R. Rajesh Jeba Anbiah" <ng**********@r ediffmail.com> napisal w
wiadomosci news:ab******** *************** ***@posting.goo gle.com...
Won't work if cookie is off. You get a fresh session every time.


Nope. Session will work even without cookies--ie, with transid


Would someone trying to break into the system happily supply the id? I think
not.


That is the different problem with the trans_sid. But, I just
wanted to say that session will work if trans_sid is enabled.

--
"Success is not what you achieve, but it is what you die for"
If you live in USA, please support John Edwards.
Email: rrjanbiah-at-Y!com
Jul 17 '05 #8

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

2
1206
by: spike | last post by:
I tried to upload a .htaccess-file to the directory that i wanted to protect. This is what I wrote in it: ------------------------------------------------ <Limit GET> order deny,allow deny from all allow from mydomain.com </Limit>
2
1489
by: Galahad | last post by:
I have a current requirement to deny access to a particular website from a list of domains. I can add these domains to a deny list in IIS, however that doesn't give me the ability detect these domains and then redirect users to specific deny pages based on the domains to which they are members. I can include a function on all of my webpages to detect the various domains and redirect users, however this would be a very tedious process...
0
3282
by: bettervssremoting | last post by:
To view the full article, please visit http://www.BetterVssRemoting.com Better VSS Remote Access Tool including SourceOffSite, SourceAnyWhere and VSS Remoting This article makes a detailed comparison among SourceAnyWhere, SourceOffSite, VSS Remoting and possible others.
2
2616
by: dale zhang | last post by:
Hi, I am writing a subscription page in C#. I first check if username is unique by "SELECT UserName FROM Logins WHERE Username ='dadada'" Then if unique, I create the user by "INSERT INTO Logins (UserName,UserType,Password,StartDate,Status,Email,Phone,Home) VALUES
4
12149
by: Dan | last post by:
hi ng. i have a strange behaviour when i want to control who can access a web application by setting web.config like: <authorization> <allow users="DOMAIN\ACCOUNT,..." /> <deny users="*" /> the authorization is working fine, but the user receives the standard "The page cannot be displayed"
5
16426
by: profdotnet | last post by:
Below is the code of web.config file: <configuration> <system.web> <authentication mode="Forms" /> <authorization> <allow users="Admin"/> <deny users="Jack,Mary" /> <deny users="?"> </authorization>
1
1885
by: dixcyn04 | last post by:
Ok, now I've run into another little hiccup in my application. The ability to update records already in existance. What is bugging me about this, is the code I will submit was what I found on forums and suggestions here and there on the Internet and very similiar to what is suggested on this forum too. I've begun toi regret not having SQL Server for this little exercise I am coding since much of the code I have written in the past worked just...
0
6553
by: Jankie | last post by:
Good morning everyone Am hopeful that someone can share me some advice as to the best .htaccess example for a site under development. When i use something like this: <Limit GET POST> order deny,allow deny from all allow from my ip
10
409
by: Les Desser | last post by:
In article <fcebdacd-2bd8-4d07-93a8-8b69d3452f3e@s50g2000hsb.googlegroups.com>, The Frog <Mr.Frog.to.you@googlemail.comMon, 14 Apr 2008 00:45:10 writes Thank you for that. It was very clear and I actually understand it!
0
8349
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
8695
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
8460
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
8576
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
1
6157
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
5609
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
1
2696
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
1
1906
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
2
1585
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.