I noticed that there doesn't seem to be any way to limit (failed) public key authentication attempts. Which could be a security issue.
Seems like only way currently to limit authentication attempts (similar fashion to OpenSSH MaxAuthTries configuration option), is for user authentication callback function to implement counting failed attempts and send WOLFSSH_USERAUTH_REJECTED when it determines too many attempts has been made?
When implementing limit on failed authentication attempts via "userAuthCb" callback function, I noticed this didn't work on public keys (potential attacker could try unlimited number of public keys), while it worked fine for password authentication attempts...