topic Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA) in Aerohive Migrated Content

Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

carsten_buchena — Wed, 26 Jun 2019 22:48:02 GMT

Since the upgrade to 19.5.1.7-NGVA, we noticed that users who enter a wrong PPSK (type SERVICE) are being locked for 1 hour immediately. Previously, they had a few tries before being locked.

Is this a new/expected behaviour? Is there a way to change it?

Thanks,

carsten

Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

samantha_lynn — Thu, 27 Jun 2019 02:05:16 GMT

Hi Carsten, I tested in our lab (also on 19.5.1.7) and we had to enter an incorrect password 5 times before it locked us out. I would recommend opening a case so our engineers can do a root cause analysis with you to see why the user lock down is triggering early.

Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

carsten_buchena — Thu, 27 Jun 2019 02:54:14 GMT

Thanks Sam! I will do that and let you know / update this thread.

Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

dparsons — Thu, 27 Jun 2019 04:14:22 GMT

If I had to throw a wild guess at it I would say that the client may be trying multiple times and causing the lock out. I would watch it in client monitor as well. You could also try it on a different platform and see if the behavior is the same.

Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

carsten_buchena — Thu, 25 Jul 2019 18:22:41 GMT

Sorry for late answer - Doug, looks like your guess was right. The client is trying 3 times, so if a wrong key is entered 2 times, it's enough to lock the Client:

2019-07-25 13:14:02LAS-VT-F0-IT-OfficeE01C4106B168Basic

Rx auth <open> (frame 1, rssi -54dB)2019-07-25 13:14:02LAS-VT-F0-IT-OfficeE01C4106B168Basic

Tx auth <open> (frame 2, status 0, pwr 10dBm)2019-07-25 13:14:02LAS-VT-F0-IT-OfficeE01C4106B168Basic

Rx assoc req (rssi -54dB)2019-07-25 13:14:02LAS-VT-F0-IT-OfficeE01C4106B168Basic

Tx assoc resp <accept> (status 0, pwr 10dBm)2019-07-25 13:14:02LAS-VT-F0-IT-OfficeE01C4106B168Info

Sending 1/4 msg of 4-Way Handshake (at if=wifi1.1)2019-07-25 13:14:02LAS-VT-F0-IT-OfficeE01C4106B168Info

Received 2/4 msg of 4-Way Handshake (at if=wifi1.1)2019-07-25 13:14:06LAS-VT-F0-IT-OfficeE01C4106B168Info

Sending 1/4 msg of 4-Way Handshake (at if=wifi1.1)2019-07-25 13:14:06LAS-VT-F0-IT-OfficeE01C4106B168Info

Received 2/4 msg of 4-Way Handshake (at if=wifi1.1)2019-07-25 13:14:10LAS-VT-F0-IT-OfficeE01C4106B168Info

Sending 1/4 msg of 4-Way Handshake (at if=wifi1.1)2019-07-25 13:14:10LAS-VT-F0-IT-OfficeE01C4106B168Info

Received 2/4 msg of 4-Way Handshake (at if=wifi1.1)

Is there any way to change the number of 5 wrong tries to something else?

Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

samantha_lynn — Thu, 25 Jul 2019 19:39:49 GMT

Unfortunately we don't have a way to edit those lock out setting currently, but I can submit a feature request for this if you'd like?

Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

carsten_buchena — Thu, 25 Jul 2019 20:02:55 GMT

Yes, I think this would be a useful feature. Thank you Sam!

Re: Wrong PPSK entry now locks a user for 1 hour immediately (19.5.1.7-NGVA)

samantha_lynn — Thu, 25 Jul 2019 20:47:18 GMT

Thanks for letting me know, I've submitted that request for you now.