title: Django brute force protection
body: <p>I want a brute force protector for logins that will:</p>
  
  <ol>
  <li>block based on username(eventually add ip)</li>
  <li>store info about failed login to db(username, pwd, user-agent, etc)</li>
  <li>When locked will tell user that they are locked out</li>
  </ol>
  
  <p>I looked at the following apps:</p>
  
  <ol>
  <li><p><a href="http://code.google.com/p/django-brutebuster/" rel="nofollow noreferrer">http://code.google.com/p/django-brutebuster/</a>
  In decorators.py the  method returns None when locked so the user gets the “Please enter a correct username and password. Note that both fields are case-sensitive”.  I want the user to know the account is locked out.</p></li>
  <li><p><a href="https://github.com/alexkuhl/django-failedloginblocker" rel="nofollow noreferrer">https://github.com/alexkuhl/django-failedloginblocker</a>
  In decorators.py the  method raises an exception which means if debug=False the user will see a 500 error.</p></li>
  <li><p><a href="http://code.google.com/p/django-axes/" rel="nofollow noreferrer">http://code.google.com/p/django-axes/</a>
  This doesn't include the user (has ip and user-agent).  In decorators.py  I'm not sure how to get the user name.  Also I'm concerned about the approach of trying to log someone in and then logging them out if the account is locked.  I like the approaches of #1 and #2 where they first check if the account is locked before trying to log them in. </p></li>
  </ol>
  
  <p>For #1 and #2 I looked into adding the error to the form and I found this post <a href="https://stackoverflow.com/questions/5523928/django-error-message-in-custom-auth-backend">Django - Error Message in Custom Auth Backend</a> that says overwrite django.contrib.auth.forms.AuthenticationForm but I'm not sure how to incorporate the new form in the apps.  </p>
  
  <p>Does anyone have suggestions about writing a brute force protector that will do the things I want?</p>