3

Possible Duplicate:
Why a wrong password gives a big delay

Whenever I mistype my password when logging in in a tty, I have noticed that I have to wait for a second before I'm able to log in again. I can't seem to find the reason for this nor what is causing it. I can only think of this being some security layer preventing from bruteforcing logins from a scripted HID attached to the machine. Is there a wayto shorten the delay? If I'm correct I see the same behavior in kdm and other screenlocks.

Community
  • 1
Silverrocker
  • 1,835

2 Answers2

5

Your assumption about it being used to mitigate brute force attacks is correct. In Linux, this is handled by the pam_faildelay module. There is a way to shorten the delay, but it is likely OS-specific. In Linux, the /etc/pam.d/login file contains the policy used for login(1).

Here is an example line from a default debian install:

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

You can adjust the delay on this line.

jordanm
  • 42,678
0

That slight delay makes it harder to guess the password, at least for a human. It might be worth looking at some source code to see if there's a deliberate constant-time comparison of the hashed candidate password and the stored hashed password, in order to prevent timing attacks.

A slight delay doesn't seem like much, but then most of us live in houses with glass windows that can be easily broken, yet we still lock the front door.