Jump to content

Manual:$wgPasswordAttemptThrottle

From mediawiki.org
This page is a translated version of the page Manual:$wgPasswordAttemptThrottle and the translation is 83% complete.
利用者権限、アクセス制御、モニタリング: $wgPasswordAttemptThrottle
IP アドレス/利用者ごとにパスワードの試行回数を制限する。
導入されたバージョン:1.14.0 (r38886)(git #6fcfa981)
除去されたバージョン:使用中
許容される値:(配列)
既定値:下記参照

詳細

IP アドレス/利用者ごとにパスワードの試行回数を「回数/秒数」で制限します。

動作させるには、$wgMainCacheType の値を CACHE_NONE 以外のいずれかに設定してください。

無効にするには、以下を LocalSettings.php に記載してください:

$wgPasswordAttemptThrottle = false;
MediaWiki バージョン:
1.27

Multiple thresholds can be added. They will all be tested separately.

既定値

MediaWiki バージョン:
1.27
/**
 * Limit password attempts to X attempts per Y seconds per IP per account.
 *
 * Value is an array of arrays. Each sub-array must have a key for count
 * (ie count of how many attempts before throttle) and a key for seconds.
 * If the key 'allIPs' (case sensitive) is present, then the limit is
 * just per account instead of per IP per account.
 *
 * @since 1.27 allIps support and multiple limits added in 1.27. Prior
 *   to 1.27 this only supported having a single throttle.
 * @warning Requires $wgMainCacheType to be enabled
 */
$wgPasswordAttemptThrottle = [
	// Short term limit
	[ 'count' => 5, 'seconds' => 300 ],
	// Long term limit. We need to balance the risk
	// of somebody using this as a DoS attack to lock someone
	// out of their account, and someone doing a brute force attack.
	[ 'count' => 150, 'seconds' => 60 * 60 * 48 ],
];
MediaWiki バージョン:
1.14 – 1.26
/**
 * Limit password attempts to X attempts per Y seconds per IP per account.
 *
 * @warning Requires memcached.
 */
$wgPasswordAttemptThrottle = array( 'count' => 5, 'seconds' => 300 );

関連項目