On Tue, Jan 26, 2010 at 12:51:45PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
On 01/25/2010 11:51 AM, Sumit Bose wrote:
> this patch adds a counter for failed login attempts when offline. This
> should fix https://fedorahosted.org/sssd/ticket/78
We discussed on IRC that we should really have an additional option
"failed_login_delay". If we receive "failed_login_count" tries, the
login delay should kick in and prevent logins for n minutes. If set to
zero, we lock the user out completely.
This is probably a better solution than the current one, which always
locks the user out. I'd like to avoid the inevitable situation where
someone is locked out while out of the country. Performing an online
auth in this situation may be infeasible.
I also think that the failed_login_count+delay should be available for
online auths as well, to prevent brute-force attacks against the server.
This new version of the patch adds the option offline_failed_login_delay. I
think we should this scheme for the local domain, too, but with a
separate set of config options (failed_login_count and
failed_login_delay in the domain section).
I'm not sure about the general online case because we might interfere
with policies on the server.