Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Why a wrong password gives a big delay

Whenever I mistype my password when logging in in a tty, I have noticed that I have to wait for a second before I'm able to log in again. I can't seem to find the reason for this nor what is causing it. I can only think of this being some security layer preventing from bruteforcing logins from a scripted HID attached to the machine. Is there a wayto shorten the delay? If I'm correct I see the same behavior in kdm and other screenlocks.

share|improve this question

marked as duplicate by Michael Mrozek Oct 24 '12 at 6:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 5 down vote accepted

Your assumption about it being used to mitigate brute force attacks is correct. In Linux, this is handled by the pam_faildelay module. There is a way to shorten the delay, but it is likely OS-specific. In Linux, the /etc/pam.d/login file contains the policy used for login(1).

Here is an example line from a default debian install:

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

You can adjust the delay on this line.

share|improve this answer

That slight delay makes it harder to guess the password, at least for a human. It might be worth looking at some source code to see if there's a deliberate constant-time comparison of the hashed candidate password and the stored hashed password, in order to prevent timing attacks.

A slight delay doesn't seem like much, but then most of us live in houses with glass windows that can be easily broken, yet we still lock the front door.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.