🚀 go-pugleaf

Hi,

I remember seeing sometime ago, a reference to limiting the frequency
with which someone could repeatedly login and test a password.

It seemed (from hazy memory) to rely on a pause inserted in the code
of login.  On recent reflection, it seemed to me that such a device
would not be sufficiently limiting, since opening several ports,
all with logins running would multiply the number of tries per second.

The only solution I could find would be to limit the frequency of
reading the passwd file, say to once per second.  Only on larger
systems where 50 people try to login at the same time (and how often
does that happen?) would such a limit cause inconvenience.

Can anyone comment on the practicality, viablility and added security
of such a beastie?

I take it for granted that it would only act to protect systems from
external attack, and where there are no 'stupid' passwords which can
be cracked in < 500 attempts.

1 try per second would reduce the attempts to 3,600 per hour.  Is that
sufficiently slow?

Of course, without a shadow password mechanism, anyone with access to
the machine can
still copy the passwd file and use crack on the copy, but isn't added
protection from external attack  still useful?

Comments?

Danny