Brute Force in WSO2 carbon

Question

How can prevent wso2 carbon or publisher or store Brute Force??

for example have a captcha or have maximum try for example lock user for 5 fault try

or any thing can prevent Brute Force? I use free wso2 and I don't have WUM , ...

Answer 1

You can lock an account based on the following use cases.

1. Account locking by failed login attempts
2. Account locking by an administrative user

Please refer https://apim.docs.wso2.com/en/latest/install-and-setup/setup/security/user-account-management/#account-locking for more details

Answer 2

I assume you are using last or one of the lastest versions of WSO2 API Manager. If you deploy it with WSO2 Identity Server as AM Key Manager you can set up captcha for login porpuoses if you set up devportal (store) and publisher with SSO. It is the regular solution for the problem you are describing.

https://is.docs.wso2.com/en/latest/learn/setting-up-recaptcha/

In addition you may use a specialiced tool to avoid DoS/DDoS and brute force attacks. Here there is a list:

https://serverguy.com/security/open-source-web-application-firewall/