Assigning to you serg for design.

A possible implementation: ACL_USER has a failed_logiins counter. It's incremented when a login fails, it's reset to 0 when a login succeeds. When it reaches a certain limit all future logins fail too. FLUSH PRIVILEGES resets it, obviously. The limit can be set by a global variable.

It'd need some safeguards to avoid blocking a root user. First, it's per account, so root@localhost can only be blocked if somebody can brute-force from localhost. Second, failed_logins could only be incremented for a failed password, so falied loigins using unix_socket plugin will never block an account.

When it reaches a certain limit all future logins fail too. FLUSH PRIVILEGES resets it, obviously. The limit can be set by a global variable.

Couldn't the limit be set per user? Maybe using the global variable just as a default. Per role would be nice. But given that the role can be changed for a user, that would not work.

It could be, of course. But we don't have a per-host limit, either — and it seems to work good enough. Different per-user limits look like overengineering to me.