[SSSD] [PATCH] Add offline failed login counter

Stephen Gallagher sgallagh at redhat.com
Tue Jan 26 17:51:45 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/25/2010 11:51 AM, Sumit Bose wrote:
> Hi,
> 
> this patch adds a counter for failed login attempts when offline. This
> should fix https://fedorahosted.org/sssd/ticket/78.
> 
> bye,
> Sumit
> 

We discussed on IRC that we should really have an additional option
"failed_login_delay". If we receive "failed_login_count" tries, the
login delay should kick in and prevent logins for n minutes. If set to
zero, we lock the user out completely.

This is probably a better solution than the current one, which always
locks the user out. I'd like to avoid the inevitable situation where
someone is locked out while out of the country. Performing an online
auth in this situation may be infeasible.

I also think that the failed_login_count+delay should be available for
online auths as well, to prevent brute-force attacks against the server.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAktfK7EACgkQeiVVYja6o6PzAwCfQNYlPYbHg1lYZW6Vq5d28QMO
GA0AnRyysjsLTuy7CKItBolKoZD1e+v+
=QctR
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list