Magento 2 admin account locked by brute force attack – unlock and protection

An administrator account was locked after a dictionary attack – 10,000 login attempts in one hour. Magento locks an account after 6 failed attempts for 30 minutes. Problem: the attacker kept resetting the counter by changing IP, while the real admin could not log in. Fix time: 1 hour.

Symptoms

• Admin cannot log in – “Account is locked”
• “Forgot password” reset does not help – email not arriving (inbox full of alerts)
• Nginx access log: thousands of POSTs to /admin_XXXXX/admin/ from different IPs
• Account locks again minutes after unlocking

Immediate unlock

UPDATE admin_user
SET failures_num = 0,
    first_failure = NULL,
    lock_expires = NULL
WHERE username = 'admin';

Stopping the attack

awk '{print $1}' /var/log/nginx/access.log \
  | sort | uniq -c | sort -rn | head -30

iptables -A INPUT -s 185.220.0.0/16 -j DROP

geo $allowed_ip {
    default  0;
    1.2.3.4  1;  # office
    5.6.7.8  1;  # VPN
}
server {
    location /admin_XXXXX/ {
        if ($allowed_ip = 0) { return 403; }
    }
}

Long-term hardening

bin/magento setup:config:set --backend-frontname="panel_$(openssl rand -hex 6)"
bin/magento module:enable Magento_TwoFactorAuth
bin/magento setup:upgrade

Takeaways

The /admin URL is scanned automatically by bots several times a day. Changing the URL, IP whitelist and 2FA together make brute force practically impossible. Fail2ban as an additional layer blocks attackers after 3 failed attempts before they reach Magento.