Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraAccountLockoutSpike

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

More than ten brute-force locks were applied in 15 minutes.

Meaning

nauthera_auth_account_lockouts_total rose by more than the threshold (10) in 15 minutes. A lock is applied after auth.brute_force.max_failed_attempts (5) failures against one email address in one organization, to an account or to an address no account holds, and each re-lock counts. Many locks at once mean a guessing campaign across many accounts, or someone locking users out to deny them service.

Impact

End users whose accounts are locked cannot sign in, even with the right password, until the lock lapses (auth.brute_force.lockout_duration, 15m, doubling up to lockout_max, 1h, with lockout_backoff). Attempts against a locked account neither count as failures nor extend the lock. Relying parties see those users fail to sign in; support may receive calls. Security: a guessing campaign is underway.

Diagnosis

  1. The rate over time: increase(nauthera_auth_account_lockouts_total\{ job="<name>"\}[15m]), next to sum by (result) (rate(nauthera_auth_logins_total\{job="<name>"\}[15m])).
  2. Which accounts and from where: the dashboard's Threats page (the Accounts locked signal and Behind the refused sign-ins), or the audit records GET /v1/admin/orgs/<slug>/audit-events?action=auth.account.locked; each carries attempts, locked_until and limit_scope (an account, or an identifier no account holds).
  3. Whether the locks cluster on one organization, a few addresses or a list of identifiers that mostly do not exist (enumeration).

Mitigation

  • Block the attacking addresses or networks at the ingress or WAF; locks lapse on their own once the attempts stop.
  • Unlock a legitimate user who cannot wait: from the dashboard, or POST /v1/admin/orgs/<slug>/users/<id>/unlock (needs users.lifecycle, a recent sign-in and a reason). Setting a new password also clears the lock.
  • Lower config.auth.captcha.sign_in_after so automated attempts meet a captcha first.
  • See Account lockout.

Escalation

Tell the security team, with the locked accounts' count and the source addresses. If support reports many locked-out users, involve whoever owns user communication.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.