# NautheraAccountLockoutSpike

More than ten brute-force locks were applied in 15 minutes.

## Meaning

`nauthera_auth_account_lockouts_total` rose by more than the threshold (10) in 15
minutes. A lock is applied after `auth.brute_force.max_failed_attempts` (5) failures
against one email address in one organization, to an account or to an address no account
holds, and each re-lock counts. Many locks at once mean a guessing campaign across many
accounts, or someone locking users out to deny them service.

## Impact

End users whose accounts are locked cannot sign in, even with the right password, until
the lock lapses (`auth.brute_force.lockout_duration`, 15m, doubling up to
`lockout_max`, 1h, with `lockout_backoff`). Attempts against a locked account neither
count as failures nor extend the lock. Relying parties see those users fail to sign in;
support may receive calls. Security: a guessing campaign is underway.

## Diagnosis

1. The rate over time: `increase(nauthera_auth_account_lockouts_total\{
   job="<name>"\}[15m])`, next to `sum by (result)
   (rate(nauthera_auth_logins_total\{job="<name>"\}[15m]))`.
2. Which accounts and from where: the dashboard's Threats page (the **Accounts locked**
   signal and **Behind the refused sign-ins**), or the audit records
   `GET /v1/admin/orgs/<slug>/audit-events?action=auth.account.locked`; each carries
   `attempts`, `locked_until` and `limit_scope` (an account, or an identifier no account
   holds).
3. Whether the locks cluster on one organization, a few addresses or a list of
   identifiers that mostly do not exist (enumeration).

## Mitigation

- Block the attacking addresses or networks at the ingress or WAF; locks lapse on their
  own once the attempts stop.
- Unlock a legitimate user who cannot wait: from the dashboard, or
  `POST /v1/admin/orgs/<slug>/users/<id>/unlock` (needs `users.lifecycle`, a recent
  sign-in and a reason). Setting a new password also clears the lock.
- Lower `config.auth.captcha.sign_in_after` so automated attempts meet a captcha first.
- See [Account lockout](https://www.nauthera.io/docs/v1/rate-limits#account-lockout).

## Escalation

Tell the security team, with the locked accounts' count and the source addresses. If
support reports many locked-out users, involve whoever owns user communication.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.