Editing Config Options by File (section)

=== [[user_auth_limits.pl]] ===
* '''max_login_attempts''' - The maximum number of failed login attempts before an account is temporarily locked.  (Default is <code>10</code> failed login attempts).
* '''lockout_minutes''' - The number of minutes an account is locked out if there have been too many failed login attempts.  (Default is <code>10</code> minutes the account is locked out).
* '''reset_request_recent_hours''' - How many hours between a user being able to request password reset links. (Default is <code>24</code> hours between reset password emails to avoid users being spammed incessantly, if reset password misused).
* '''max_account_requests''' - The maximum number of new user accounts can be requested (through <code>/cgi/register</code> in <code>max_account_requests_minutes</code>.  (Default is <code>100</code> user accounts.  This is quite high, as you may get a lot of people all trying to sign up at once if a mass email is sent round to an organisation asking everyone to sign up).
* '''max_account_requests_minutes''' - The size of the window in minutes to check if <code>max_account_requests has been exceeded</code>.  (By default <code>60</code> minutes, 1 hour).
* '''password_maxlength''' - Sounds counter-intuitive but really long passwords can take a long time and a lot of resources to hash.  So a limit prevents such a DoS attack. (By default <code>200</code> characters).
Also adds a [[Triggers#EP_TRIGGER_VALIDATE_FIELD|<code>EP_TRIGGER_VALIDATE_FIELD</code> trigger function]] to validate that the length of the password submitted is not too long.
* '''login_monitoring'''
** '''enabled''' - Whether monitoring of logins (both failed and successful) are logged to archive's <code>var/login_attempts/</code> directory in CSV format.  (By default <code>1</code>, i.e. enabled).
** '''fields''' - Array reference of field names to include at start of file as column headers.  (Commented out by default and only needed if <code>function</code> is also defined.  The commented out fields: <code>timestamp, username, password_length,ip_address, user_agent, target, login_status, userid, securecode</code> are the same as those hard-coded).
** '''function''' - Defines a function for generating a bespoke log message (CSV line) for a login attempt. (Commented out by default but function is the same as what is hard-coded).