3

Possible Duplicate:
Why a wrong password gives a big delay

Whenever I mistype my password when logging in in a tty, I have noticed that I have to wait for a second before I'm able to log in again. I can't seem to find the reason for this nor what is causing it. I can only think of this being some security layer preventing from bruteforcing logins from a scripted HID attached to the machine. Is there a wayto shorten the delay? If I'm correct I see the same behavior in kdm and other screenlocks.

marked as duplicate by Michael Mrozek Oct 24 '12 at 6:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

5

Your assumption about it being used to mitigate brute force attacks is correct. In Linux, this is handled by the pam_faildelay module. There is a way to shorten the delay, but it is likely OS-specific. In Linux, the /etc/pam.d/login file contains the policy used for login(1).

Here is an example line from a default debian install:

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

You can adjust the delay on this line.

0

That slight delay makes it harder to guess the password, at least for a human. It might be worth looking at some source code to see if there's a deliberate constant-time comparison of the hashed candidate password and the stored hashed password, in order to prevent timing attacks.

A slight delay doesn't seem like much, but then most of us live in houses with glass windows that can be easily broken, yet we still lock the front door.

Not the answer you're looking for? Browse other questions tagged or ask your own question.