Implement Authn lockout/throttle implementation

[carsonoid]

Right now there isn't anything that detects and responds to repeated failed authentication attempts. What do you think about implementing a lockout policy or throttling system?

[rojer]

no objections in principle. what criteria for lockout do you propose?

[allingeek]

I'd rather see an auth_log_file parameter so we can just use fail2ban.