Authentication Pane

Getting there

From the server console, click Configuration > Authentication.

The options are:

Grace time for completion of authentication process (seconds)

Sets the number of seconds allowed for client authentication. If the client fails to authenticate the user within the specified number of seconds, the server disconnects and exits. Use zero (0) to set no limit.

NOTE:Specifying no limit (0) is not recommended. Unauthenticated connections use up system resources and can lead to a denial-of-service condition.

IP blocking

You can use the IP blocking settings to temporarily block connections from any client IP address that has exceeded a specified number of failed attempts. If a particular IP address exceeds the value set for Failed attempts, within the time period specified by Failure time-out, that IP address is blocked for the duration specified by Lockout duration.

NOTE:

IP blocking applies only to password authentication (both traditional password and password over Keyboard Interactive).
You can disable the IP Blocking feature by setting Failed Attempts to 0 (zero).
IP blocking information is stored in memory, and is cleared if the server is restarted.
You can lock out offending addresses permanently from the Client Host Access Control pane.

Failed attempts	Sets a maximum number of failed login attempts. To disable IP blocking, set this value to zero (0). The default is 20.
Failure time-out (seconds)	Sets a duration of time, in seconds, during which an IP address is monitored for failed login attempts. The default is 300 seconds (5 minutes).
Lockout duration (seconds)	Sets the number of seconds an IP address remains blocked after the value set for Failed attempts is exceeded. The default is 3600 seconds (one hour).

Authentication failures

You can use the Authentication failures settings to modify how the server handles client authentication failures.

CAUTION:Enabling the settings in the Authentication failures group increases your security risk by providing potential attackers with information about which client accounts are valid.

Immediately disconnect invalid, locked or denied users	By default, this option is not selected, and the server responds identically to all failed authentication attempts. When this setting is selected, blocked accounts disconnect immediately.
Provide informative messages to clients for authentication failures	By default, no information about authentication failures is sent to the client. This complies with SSH convention. When this setting is selected, the client is told when an authentication fails because of an invalid, locked, or denied user account.

Keyboard interactive

Send keyboard interactive title

This setting affects whether or not title text is displayed during keyboard interactive authentication. When it is selected (the default), the authentication prompts sent to the client include the title text. When it is not selected, the title text is not included.