Skip to main content

QlikView Administration

Discussion Board for collaboration on QlikView Management.

Announcements
Skip the ticket, Chat with Qlik Support instead for instant assistance.
cancel
Showing results for 
Search instead for 
Did you mean: 
Gatis
Contributor
Contributor

Public Qlikview Access Point user Authentication with AD - User lockout vulnerability

Hi,

I have publicly facing Qlikview Access Point that authenticates domain users using Active Directory.

Access Point run by IIS.

Penetration testing revealed that it's vulnerable to DDoS attacks, where if someone found out usernames, they could lock out all Active Directory users by entering credentials incorrectly 3 times (Active Directory policy).

Is creating local users the only solution to fix this vulnerability, so at least in case of DDoS attack only Qlikview users would be affected not the whole domain users? Or is there any way how to resolve this issue? Maybe some kind of delay between login attempts?

Thank you

Gatis

1 Solution

Accepted Solutions
Albert_Candelario

Hello @Gatis ,

Thanks for posting.

This topic looks more Microsoft related than QlikView per se as the authentication is done on the Active Directory part. Also notice the Account lockout threshold is configurable, could be 3 times or 10 times as your AD administrator has set up.

Find here some  documentation from Microsoft and best practises on the same topic:
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account...

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account...

On the links it also talks about Local users and there is a some best practises sections.

I hope this is useful for the concern you have raised here.

Cheers,

Please, remember to mark the thread as solved once getting the correct answer

View solution in original post

2 Replies
Albert_Candelario

Hello @Gatis ,

Thanks for posting.

This topic looks more Microsoft related than QlikView per se as the authentication is done on the Active Directory part. Also notice the Account lockout threshold is configurable, could be 3 times or 10 times as your AD administrator has set up.

Find here some  documentation from Microsoft and best practises on the same topic:
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account...

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account...

On the links it also talks about Local users and there is a some best practises sections.

I hope this is useful for the concern you have raised here.

Cheers,

Please, remember to mark the thread as solved once getting the correct answer
Gatis
Contributor
Contributor
Author

Thanks @Albert_Candelario