---
title: 'Tutorial: Configure the Authentication Failure Lockout Policy'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--authentication-failure-lockout-policy/
product: Access Server Docs
description: Learn how to configure the authentication failure lockout policy in Access Server. This guide covers the Admin Web UI and command-line methods to manage lockout settings effectively.
---

# Tutorial: Configure the Authentication Failure Lockout Policy

## Overview

Access Server automatically locks out user accounts after repeated failed authentication attempts to prevent brute-force attacks. When locked out, users see messages like "**LOCKOUT**" or "**User temporarily locked out due to multiple authentication failures**."

- **Access Server 2.10 and newer:** The lockout triggers after **five** failed attempts within **15 minutes** and expires after **15 minutes**.
- **Access Server 2.9 and older:** Lockout triggers after **three** failed attempts and expires after **15 minutes**.
- Access Server tracks incorrect passwords in a lockout dictionary (stored as hashes). The dictionary is purged if it reaches its limit. The default settings are usually sufficient, but high-volume environments may require adjustments.
- External authentication systems (LDAP, RADIUS, SAML) may have their own lockout policies.
- **Exceptions for Access Server 2.9 and older ONLY:** User-locked connection profiles and bootstrap accounts don't trigger lockouts.

Admins can modify lockout settings or manually lift a lockout if needed.

## Prerequisites

- Installed Access Server.
  - If you're configuring the policy using the Admin Web UI, you need Access Server 2.10.2 or newer.
- Admin Web UI access or console access with root privileges.

## Option 1: Configure the lockout policy in the Admin Web UI

For OpenVPN Access Server 2.10.2 and newer:

1. Sign in to the Admin Web UI.
2. Click **Authentication \> Settings**.
3. Adjust settings under the **Password Lockout Policy** section as needed.
4. Select **Save Settings** and **Update Running Server**.

## Option 2: Configure the lockout policy via the command-line interface (CLI)

1. Connect to the console and get root privileges.
2. Switch to the scripts directory:

   ```
   cd /usr/local/openvpn_as/scripts/
   ```
3. Use the following commands to configure the lockout policy:
   - Set the number of authentication failures (default is 5):

     ```
     ./sacli --key "vpn.server.lockout_policy.n_fails" --value <NUMBER> ConfigPut
     ./sacli start
     ```
   - Set the lockout duration (default is 900 seconds or 15 minutes):

     ```
     ./sacli --key "vpn.server.lockout_policy.reset_time" --value <SECONDS> ConfigPut
     ./sacli start
     ```
   - Set the maximum size of the lockout dictionary (default is 10000):

     ```
     ./sacli --key "vpn.server.lockout_policy.max_history" --value <BYTES> ConfigPut
     ./sacli start
     ```

---

Prev: [Tutorial: Understanding Local Password Hashing in Access Server](https://openvpn.net/as-docs/tutorials/tutorial--local-password-hashing.md)
Next: [Tutorial: Protect the Admin and Client Web UIs from Brute-Force Attacks with Fail2Ban](https://openvpn.net/as-docs/tutorials/tutorial--protect-web-uis-from-brute-force-attacks-with-fail2ban.md)
Index: https://openvpn.net/as-docs/llms.txt