jjxtra/Windows-IP-Ban-Service — pull request #8 by primaryobjects (2012-04-15 00:51:53+00:00)
Title: Added feature to forget IPs that have not made an invalid login attempt within a certain amount of time.

Great tool. I've been looking for a while, for a way to block those annoying brute force hack attempts. I've added another tweak:

Added feature to forget IPs that have not made an invalid login attempt within a certain amount of time.
Example: An IP is forgotten (count reset back to 0) if it waits 30 minutes after its last failed login attempt.

This allows for the case where a user enters the wrong password once, but then successfully logs in. Previously, the blocker would still hold a count of 1 for his IP. In this case, the user could end up being banned over a period of time from entering the password incorrectly just once each session, even though he remembers his password eventually (maybe a month down the line if the service remained running that long, he enters the password wrong for the Nth time and gets blocked). This new option resets him back to 0 after a certain amount of time.

The option can also be disabled by just setting it to 00:00:00:00.

To test it, edit the app.config:
FailedLoginAttemptsBeforeBan = 3
BanTime = 00:00:00:20
ExpireTime = 00:00:00:20

Run:
99.99.99.99 gets banned immediately from 3 test failed login attempts.
99.99.99.98 gets a count of 1 from 1 test failed login attempt.
99.99.99.100 gets a count of 1 from 1 test failed login attempt.

99.99.99.98 gets a count of 2 about 15 seconds later from a delayed test failed login attempt.
99.99.99.99 gets unbanned

99.99.99.100 gets forgotten after the ExpireTime delay (never got banned)

99.99.99.98 gets forgotten a bit later since it had a more recent test failed login attempt (never got banned)