UID 1 is immune to hard block [#1858092]

Is it by design that UID 1 cannot be hard blocked regardless of failed login attempts? While this seems the most likely account for an attempted hack, it would also leave a site vulnerable to being crippled by a few malicious (or accidental) failed logins if this were the only privileged user of a site.

Comment	File	Size	Author
#3	1858092-3.patch	654 bytes	divyansh

Comments

Comment #1

deekayen commented 6 February 2013 at 16:06

Version:

6.x-1.1

» 7.x-1.x-dev

Bumping version.

Comment #2

shrop commented 2 September 2013 at 18:39

I am not sure of the best approach here, but it does seem standard for systems to block any account. Ex: host deny systems for unix firewalls. Would it be possible to add documentation to explain all users can be hard blocked, recommend having alternative admin accounts (as you should anyway), and instructions to unblock via direct database manipulation if all else fails?