Ory Kratos provides protection against brute-force attacks by rate limiting requests to API public endpoints, such as login and registration endpoints. However, the specific configuration for setting the limit for login attempts or password reset attempts is not explicitly mentioned in the provided extracts. When self-hosting the Ory Kratos Identity Server, it's the responsibility of the administrator to implement and manage rate limiting or other measures to ensure the security of the network. For more detailed information, you may want to refer to the [Ory Kratos documentation](https://www.ory.sh/docs/kratos/concepts/security).