🚀 go-pugleaf

In article <1992Aug12.050417.3340@qiclab.scn.rain.com>, leonard@qiclab.scn.rain.com (Leonard Erickson) writes:
> daniel@vcp1.vcp.monash.edu.au writes:
> 
>>I remember seeing sometime ago, a reference to limiting the frequency
>>with which someone could repeatedly login and test a password.

[ misc deleted about limiting access to passwd file ]
> 
>>Comments?
> 
> It's *much* simpler to just keep a record of invalid password attempts.
> If a login gets too many in a set period, the account is locked out
> for a period of time.
> 
> For example, on Novell Netware, if there are more than 7(?) invalid login
> attempts in 15 minutes, the account is locked out for another 15 minutes.
> (these are what I recall the defaults being). You can configure all of
> these parameters. 
> 
> Since all of these lockouts are both logged *and* sent to the console,
> this not only slows the attacks to a crawl, but leaves a trail a mile
> wide!

VMS uses a similar mechanism.  After a predetermined number of unsuccessful
logins, the account is temporarily unavailable for logins.  As the unsuccessful
login attempts continue, the length of time the account is unavailable
increases.  And the user attempting to login has no clue that this evasion is
taking place as the error reported to the user is the same one that is used
under normal circumstances.

Ken

-- 
-------------------------------------------------------------------------------
**  Ken Brucker -- VMS/Ultrix Systems Programmer/Mangler -- Computer Vision
 **  kjb@calmasd.Prime.COM  
  **  Practice Random Kindness and Senseless Acts of Beauty