# Securing the login page

**URL:** <https://discourse.getcockpit.com/t/securing-the-login-page/704>\
**Category:** Support\
**Created:** [April 2, 2019, 8:03pm UTC](https://discourse.getcockpit.com/t/securing-the-login-page/704 "2019-04-02T20:03:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rexdjw](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@rexdjw](https://discourse.getcockpit.com/u/rexdjw)\
**Post date:** [April 2, 2019, 8:03pm UTC](https://discourse.getcockpit.com/t/securing-the-login-page/704/1 "2019-04-02T20:03:35Z")

</div>

Hi,

I am running cockpit via the author maintained docker. I’m wondering if there’s a good way to secure the login page against brute force? I use nginx and fail2ban with my site, but I’m not sure how to get fail2ban to monitor the docker’s logs? Or if there is a simpler way to add a timeout function to the login page?

Thanks,  
Rex

---

<div class="post-metadata">

**Author:** ![pauloamgomes](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pauloamgomes/32/48_2.png) [@pauloamgomes](https://discourse.getcockpit.com/u/pauloamgomes)\
**Post date:** [April 6, 2019, 9:46am UTC](https://discourse.getcockpit.com/t/securing-the-login-page/704/2 "2019-04-06T09:46:39Z")

</div>

@rexdjw, that is possible now (after [https://github.com/agentejo/cockpit/issues/1075](https://github.com/agentejo/cockpit/issues/1075)) using the Logger addon ([https://github.com/pauloamgomes/cockpit-logger-addon](https://github.com/pauloamgomes/cockpit-logger-addon)), that would provide logging (file or rsyslog) about the failed logins so you can have specific rules with fail2ban, e.g.:

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/getcockpit/original/1X/f4b84812e9735bfe0a58b8595be1713302b5bb04.png)