On Thu, Jan 28, 2010 at 02:52:21PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
On 01/27/2010 11:48 AM, Sumit Bose wrote:
> This new version of the patch adds the option offline_failed_login_delay. I
> think we should this scheme for the local domain, too, but with a
> separate set of config options (failed_login_count and
> failed_login_delay in the domain section).
> I'm not sure about the general online case because we might interfere
> with policies on the server.
Nack. Please specify in the SSSDConfig API that the time is in minutes.
I think it would be more correct to return EIO if we fail to get the
login delay or allowed attempts from confdb. EACCESS implies that we
The DEBUG messages after failure to save SYSDB_LAST_LOGIN and
SYSDB_FAILED_LOGIN_ATTEMPTS are wrong.
I'm not sure if this was intentional or not: if I'm reading this
correctly, we're still saving the last failed login time every time it
fails, even if we're already in the 5-minute waiting period. So,
effectively, it's going to deny forever unless they wait five minutes.
no, you are wrong, if check_failed_login_attempts() fails or denies
access nothing is changed or updated.
I think we probably want to stop storing the last failed login time once
we hit our failed login counter, otherwise things might be frustrating
for the user.
On the other hand, this is a great way to defeat brute-force attacks, so
I'm not sure how we want to proceed on this.
I think this would be an unexpected behaviour and it might be a bit
annoying to a user who didn't look too closely on his watch and retried
after 4 minutes and 55 seconds.
Also, would it be possible to return a message to the user that they've
passed the maximum attempts and that they need to wait five minutes?
(I'm thinking something similar to your "Warn the user if authentication
happens offline" patch.
This would be possible, but wouldn't this disclose too much information
to an attacker?
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
sssd-devel mailing list