Re: Server side delay for bad passwords?

[Pierangelo Masarati <ando@sys-net.it>]

Dan White wrote:

> I'd only want a delay when a user/attacker has entered a bad password,
> similar to the way a UNIX shell introduces a delay. My concern is that
> the faster I tune my server, the more likely it will become that an
> attacker will brute force a password.


Given the current implementation, the delay will keep a thread busy for
its duration.  Your server, under attack, would quickly become
unresponsive for any user.  Probably, your case should be handled
separately, e.g. by writing an overlay that registers a delay for a
given connection and quicly releases the operation, and a background
thread that wakes up when it's time to return errors after the delay.
Nothing dramatic, but definitely needs some development.

p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
---------------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati@sys-net.it
---------------------------------------