Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try to sudo with a wrong password I would also have to wait before the shell says "Sorry, try again".

I wonder why it takes so long to "recognize" an incorrect password? This has been seen on several distributions I use (and even OSX), so I think it's not a distribution specific thing.

share|improve this question

2 Answers 2

up vote 51 down vote accepted

This is a security thing, it's not actually taking long to realize it. 2 vulnerabilities this solves:

  1. this throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk).

  2. If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to invalidate your credentials to help guess if part of your credentials were correct, dramatically reducing the guessing time.

to prevent these 2 things the system just takes a certain amount of time to do it, I think you can configure the wait time with PAM ( See Michaels answer ).

Security Engineering ( 2ed, amazon | 1ed, free ) gives a much better explanation of these problems.

share|improve this answer
    
//offtopic g its not a bug, its a feature ;-) –  echox Sep 16 '10 at 8:18
2  
Your affiliate link was automatically rewritten to SE's, btw. –  Gelatin Sep 18 '10 at 20:50
    
@Simon yeah I noticed that... very selfish of them when it's me doing the work. I changed the text of the link since it's not really mine... to lazy to actually change the link though –  xenoterracide Sep 18 '10 at 20:57
    
@xeno The 2nd point isn't clear. I don't understand what you are trying to say. Do you mind rephrasing it? –  Tshepang Dec 1 '10 at 11:11
1  
@Tshepang: See chapter 2, particularly §2.4 and §2.5.3.3. –  Gilles Dec 1 '10 at 18:42

This is intentional, to try and limit brute forcing. You can usually modify it by looking for the FAIL_DELAY configuration entry in /etc/login.defs and changing its value (mine is 3 seconds by default), although the comment in that file makes it sound like PAM will enforce at least a 2 second delay no matter what

share|improve this answer
4  
This is to prevent more than just brute forcing. but bonus points for knowing where to configure it. –  xenoterracide Sep 16 '10 at 5:33
3  
I think that the fail_delay is also configurable in /etc/pam.d/login. Look for pam_faildelay.so delay= –  Steven D Sep 16 '10 at 5:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.