-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/27/2010 11:48 AM, Sumit Bose wrote:
This new version of the patch adds the option
offline_failed_login_delay. I
think we should this scheme for the local domain, too, but with a
separate set of config options (failed_login_count and
failed_login_delay in the domain section).
I'm not sure about the general online case because we might interfere
with policies on the server.
Nack. Please specify in the SSSDConfig API that the time is in minutes.
I think it would be more correct to return EIO if we fail to get the
login delay or allowed attempts from confdb. EACCESS implies that we
explicitly failed.
The DEBUG messages after failure to save SYSDB_LAST_LOGIN and
SYSDB_FAILED_LOGIN_ATTEMPTS are wrong.
I'm not sure if this was intentional or not: if I'm reading this
correctly, we're still saving the last failed login time every time it
fails, even if we're already in the 5-minute waiting period. So,
effectively, it's going to deny forever unless they wait five minutes.
I think we probably want to stop storing the last failed login time once
we hit our failed login counter, otherwise things might be frustrating
for the user.
On the other hand, this is a great way to defeat brute-force attacks, so
I'm not sure how we want to proceed on this.
Also, would it be possible to return a message to the user that they've
passed the maximum attempts and that they need to wait five minutes?
(I'm thinking something similar to your "Warn the user if authentication
happens offline" patch.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkth6u8ACgkQeiVVYja6o6NC/QCfavL52lGlMjmggte/NeK8onPv
zZwAmgJHhaKywKvltDZh/wmtt49aDmB4
=RtX3
-----END PGP SIGNATURE-----