🚀 go-pugleaf

daniel@vcp1.vcp.monash.edu.au writes:

>I remember seeing sometime ago, a reference to limiting the frequency
>with which someone could repeatedly login and test a password.

>It seemed (from hazy memory) to rely on a pause inserted in the code
>of login.  On recent reflection, it seemed to me that such a device
>would not be sufficiently limiting, since opening several ports,
>all with logins running would multiply the number of tries per second.

>The only solution I could find would be to limit the frequency of
>reading the passwd file, say to once per second.  Only on larger
>systems where 50 people try to login at the same time (and how often
>does that happen?) would such a limit cause inconvenience.

>Can anyone comment on the practicality, viablility and added security
>of such a beastie?

>I take it for granted that it would only act to protect systems from
>external attack, and where there are no 'stupid' passwords which can
>be cracked in < 500 attempts.

>1 try per second would reduce the attempts to 3,600 per hour.  Is that
>sufficiently slow?

>Of course, without a shadow password mechanism, anyone with access to
>the machine can
>still copy the passwd file and use crack on the copy, but isn't added
>protection from external attack  still useful?

>Comments?

It's *much* simpler to just keep a record of invalid password attempts.
If a login gets too many in a set period, the account is locked out
for a period of time.

For example, on Novell Netware, if there are more than 7(?) invalid login
attempts in 15 minutes, the account is locked out for another 15 minutes.
(these are what I recall the defaults being). You can configure all of
these parameters. 

Since all of these lockouts are both logged *and* sent to the console,
this not only slows the attacks to a crawl, but leaves a trail a mile
wide!

-- 
Leonard Erickson		      leonard@qiclab.scn.rain.com
CIS: [70465,203]			 70465.203@compuserve.com
FIDO:   1:105/51	 Leonard.Erickson@f51.n105.z1.fidonet.org
(The CIS & Fido addresses are preferred)