# User accounts and Mail setup?

**URL:** <https://forum.ghost.org/t/user-accounts-and-mail-setup/9457>\
**Category:** Developer help\
**Created:** [October 10, 2019, 8:30pm UTC](https://forum.ghost.org/t/user-accounts-and-mail-setup/9457 "2019-10-10T20:30:23Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![evilbob](https://avatars.discourse-cdn.com/v4/letter/e/51bf81/32.png) [@evilbob](https://forum.ghost.org/u/evilbob)\
**Post date:** [October 17, 2019, 6:27pm UTC](https://forum.ghost.org/t/user-accounts-and-mail-setup/9457/3 "2019-10-17T18:27:49Z")

</div>

For Issue #1 regarding **changing the brute force protection settings**

I found the following info.

> [@Disable: Too many attempts try again in an hour](https://forum.ghost.org/t/disable-too-many-attempts-try-again-in-an-hour/4087):
>
> This is perfectly acceptable in production; not so in dev mode. Is there a way to disable or increase the number of requests in dev mode? Endpoint is api/v0.1/authentication/token I’m structuring best ways to store the expires\_in to compare current date with expired date with date.setSeconds(expires\_in)

Also this is a link to the Documentation but it’s very sparse

> **[Configuration - Adapt your publication to suit your needs](https://ghost.org/docs/config/?_ga=2.45806562.77191525.1571249203-1675169351.1570734131)**
>
> Find out how to configure your Ghost publication or override Ghost's default behaviour with robust config options, including mail, storage, scheduling and more!

Looks like the file to edit is located in here: ghost/current/core/server/config/ It’s called defaults.json Look for the section that starts with “spam”: { Any changes you make require a “ghost restart” from ghostcli to take effect.

As for actually **unlocking a user when they trigger the spam prevention** rules I think I found the answer. Here are all the details I found along the way.

Looks like Ghost is using a middleware bruteforce protection called express-brute the data is stored in the Mysql database with brute-knex in the “brute” table There are 5 columns in the Brute table key,firstRequest,lastrequest,lifetime,count Count is incremented by one every time you fail a login but setting it to 0 doesn’t reset the “too many login attempts” message.

What worked for me was deleting the row in the DB where the count was increased. This unlocked the user. I’m a noob at this and This is most likely very unsafe try it at your own risk.

---

_[View the full topic](https://forum.ghost.org/t/user-accounts-and-mail-setup/9457)._