Catci – No Rate Limit in Admins login form could led to Admins ATO

On your cacti admin portal:

1. Click “Console”
2. Go to “Configuration”
3. Click on “Settings”
4. Select “Authentication” tab in the settings page
5. In the bottom section is “Account Locking” Select “Lock Accounts: number of attempts” e.g if you choose “5 Attempts”, it means the user account will be locked after 5 failed login attempts.
6. Select the “Auto Unlock” settings, e.g. “30 minutes” means the account will be auto unlocked after 30 minutes.

Doing this prevents Admin’s Account Takeover (ATO) attack via a “dictionary attack” using automated BOTs. Because the account will be locked after (y) number of failed attempts and the attacker has to wait some time before they can attempt another password. This makes it practically impossible for such brute-force attacks which require 1000s of password combinations to succeed. This combine with strong password makes your system more security hardened.