Per-user failed login limit and temporary account lock (similar to MySQL FAILED_LOGIN_ATTEMPTS / PASSWORD_LOCK_TIME)

MariaDB currently has no way to lock an individual account after repeated failed authentication attempts. The existing protection is host-level:

max_connect_errors blocks a host after repeated connections that are interrupted before authentication completes (floods, broken clients). Wrong passwords do not count towards it.
MaxScale’s max_auth_errors_until_block also blocks by client host, not by user.

This leaves two gaps:
Brute-force/password-guessing against a specific account is not limited per user. An attacker rotating source IPs, or working from behind a shared NAT or proxy, is never stopped.

Host-level blocking is too broad. When many users share a host (application servers, proxies, jump hosts), a single user’s repeated failures can block or affect everyone else on that host, or the block is never triggered at all.

Proposed feature

Add per-account options to CREATE USER / ALTER USER:

CREATE USER 'app_user'@'%' IDENTIFIED BY '...'

  FAILED_LOGIN_ATTEMPTS 3

  PASSWORD_LOCK_TIME 1;

ALTER USER 'app_user'@'%'

  FAILED_LOGIN_ATTEMPTS 5

  PASSWORD_LOCK_TIME UNBOUNDED;

FAILED_LOGIN_ATTEMPTS N: number of consecutive failed authentication attempts after which the account is temporarily locked. 0 (default) disables the feature.
PASSWORD_LOCK_TIME

: lock duration (days in MySQL; seconds or minutes may be more useful here). UNBOUNDED means the lock stays until an administrator unlocks the account.

https://dev.mysql.com/doc/mysql-security-excerpt/8.0/en/password-management.html#failed-login-tracking