Django, where to update failed login attempts and why?
What: I would actually implement that logic in an Authentication Backend.
How: Use a specific, separate, Model to track login attempts, or, use the solution suggested by miko (fail2ban). 
Why: You de-couple authentication from users. Bonus: if you want to take advantage of the upcoming pluggable User models in Django, that's a good idea.

On a side note, there probably is a way you can achieve an even "neater" solution by wrapping existing authentication backends to provide the required functionality.
I have a custom user model where I want to track number of failed login attempts and take action based on that. I am wondering what would be a better place to write this logic. 
Following are two options I have in mind for updating *failed_attempts* field in User model:

Autheticate method in the backend.
*check_password* method in the User model. I have overridden this method from AbstractBaseUser model.

And the basic logic(does not cover all cases) is like this:

If authentication fails check the time of previous failed login attempt.
If that was recent, increment failed login count.
If count reaches maximum attempt lock the account for few minutes (or do something else).

My question is what would be a better place for writing this logic and why.