Support

Hi!

We noticed on one of our sites that some users get 'deactivated' (I think by Admin Tools) after they try to login with wrong credentials. While this is probably a good security measure, in this case it's also a bit user unfriendly, at least in the way it is set up now.

We have a website that syncs users with an external application. Users can not register on the website themselves. This is why we have 'user registration' disabled.

When we go to the WAF settings in AdminTools we see the option 'Treat failed logins as a reason for blocking the request'. This is set to YES. So this is probably why Adim Tools disables users when the login incorrectly. Right?

Below this there is an option 'Deactivate user after'. This was set to 0 failed logins in 1 hour. But the setting was 'disabled' because : "User registration on your site is disabled, therefore Admin Tools can't deactivate users."

My questions:

Does (can) AdminTool deactivate users when 'User registration' is turned off? If not, then I am not sure how the users get deactivated...

If AdminTools DOES deactivate users, does it use the settings from 'Deactivate user after? In that case I would need to adjust this (to let's say to 5 failed logins every minute) to make it less strict? In order to do this we need to turn on 'user registration', change the values in the WAF setting and the turn user registration back off. Correct?

Hope you can clarify this for me.

Kind regards,

Jip

 

 

 

 

 

 

 

 

 

 

 

 

 

OK, well then something else is happening. I don't think Joomla itself would deactivate users. Except of course when a admin does this manually. But this is not the case. It could be that our sync is doing this, but I need to check this with our developer.

What would you suggest we do to somehow keep track of this? I would really like to know why these users have been deactivated. 

I assumed this was because of failed logins (wrong passwords). But I am not 100% of this. But that would be the most plausible explanation I think.

Is there a AdminTools log we can check to see if it did actually deactivate users? Or can we enable such logging to see if any actions like these are performed by AdminTools?

 

 

 

 

 

We will try to log and research. We have 4 sites with about 500 users that regularly log in. But we are not the 'day-to-day' managers of the website so we don't always get notified about issues with user that are disabled. But we do have access to the site and we will try to retrieve IP's of users that get blocked. Hope we can figure out what happens. Thanks so far!

We have been monitoring this for a while now and we do see that login failures result in users getting deactivated. I think only Admin Tools can do this and not Joomla?

So this would mean AdminsTools is blocking users even when 'user registration' is disabled on the website? Or can you think of any other reasons why users might get deactivated (other then by Admin Tools)?

 

 

 

I don't feel really comfortable disabling Admin Tools on a site with a lot of privacy sensitive information. Besides, the deactivation of users only happens one in a while. So we will never be sure when we disable Admin Tools caused the deactivation of users when no users are be deactivated in that period of time. 

I think we will leave it at this for now on our side. We'll just check periodically if users are deactivated and activate them again.

 

 

 

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.