Handle logon failures

If a user fails to log on to OceanBase Database multiple times, OceanBase Database locks the account of the user to prevent malicious password attacks. This improves the security of OceanBase Database.

Handle logon failures

OceanBase Database allows you to set the threshold for the failed attempts to log on to a MySQL tenant by specifying connection_control_failed_connections_threshold, which is a tenant-level parameter. If the number of consecutive failed logon attempts by a user exceeds the specified threshold, the system locks the account of the user.

The default value of the connection_control_failed_connections_threshold parameter is 0, and the value range is [0,2147483647]. Parameters:

• A value of 0 indicates that the feature is disabled. In this case, no action is taken against failed logon attempts.

• If you set the parameter to a value other than 0, the account of a user is locked when the number of failed logon attempts by the user exceeds the specified value. The lock duration is calculated by using the following formula:

  MIN(MAX((current_failed_login_num + 1 - connection_control_failed_connections_threshold) * 1000, connection_control_min_connection_delay), connection_control_max_connection_delay)

  Parameters:

  • current_failed_login_num: the number of consecutive failed logon attempts by a user. The value of the current_failed_login_num parameter is greater than or equal to that of the connection_control_failed_connections_threshold parameter.

  • connection_control_min_connection_delay: the minimum lock duration in milliseconds after the number of consecutive failed logon attempts exceeds the specified threshold. Value range: [1000,2147483647]. Default value: 1000.

    For more information about the connection_control_min_connection_delay parameter, see connection_control_min_connection_delay.

  • connection_control_max_connection_delay: the maximum lock duration in milliseconds after the number of consecutive failed logon attempts exceeds the specified threshold. Value range: [1000,2147483647]. Default value: 2147483647.

    For more information about the connection_control_max_connection_delay parameter, see connection_control_max_connection_delay.

Configuration example

1. Log on to a MySQL tenant of the database as the administrator.

2. Execute the following statements to set the values of the connection_control_failed_connections_threshold, connection_control_min_connection_delay, and connection_control_max_connection_delay parameters:

   Sample code:

   obclient> ALTER SYSTEM SET connection_control_failed_connections_threshold=5;
   
   obclient> ALTER SYSTEM SET connection_control_min_connection_delay=60000;
   
   obclient> ALTER SYSTEM SET connection_control_max_connection_delay=360000;
   

   For more information about the parameters, see Modify cluster parameters.