Wed Admin UI Brute Force Protection
If a user attempts to login with invalid credentials from the same ip address after 10 failed attempts, they will be locked for an hour.
The front end will give you the time that you have left, so if you try to login after you have been locked out, you will see this message:
It also should not matter if you are using a bad username or password, all that matters is that you are trying from the same ip address.
SFTP System Brute Force Protection
The SFTP system will ban an IP address for 5 hours if it has made more than 10 failed authentication attempts within 5 minutes of each other.
You can manually clear the IP lockout by restarting the Java service:
sudo su service sftpgw-admin-api restart
Or, you can disable the IP banning feature (in v3.3.0 and later).