Why is there a delay when I enter my password incorrectly?

Question

Whenever I enter my password incorrectly upon login, there's a delay before I can try again. Why is this? Is there a way to remove the delay?

Answer 1

This is a security feature according to an explanation from another Stack Exchange community. Here are the two vulnerabilities solved by that feature:

1. this (sic) throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk).

2. If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to invalidate your credentials to help guess if part of your credentials were correct, dramatically reducing the guessing time.

As to whether you can remove the delay, no, but you can modify it to a minimum of 2 seconds according to this answer. Open the file /etc/login.defs and change the value set to FAIL_DELAY.

Answer 2

Short answer:

• To reduce the rate of login attempt

• To prevent quick brute forcing of passwords.

• This makes it take longer to guess passwords.

• Greatly increase security

Comprehensive:

It's actually to prevent brute force attacks from trying millions of passwords per second. The idea is to limit how fast passwords can be checked and there are a number of rules that should be followed.

• A successful user/password pair should succeed immediately.

• There should be no discernible difference in reasons for failure that can be detected.

Not even a time difference in response between the "invalid user and password" and "valid user but invalid password" failure reasons.

Every failure should deliver exactly the same information, textual and otherwise.

Some systems take it even further, increasing the delay with each failure, or only allowing three failures then having a massive delay before allowing a retry.

The general term for this behavior is tarpitting. (wikipedia much concentrated on Networking).

From The Linux-PAM Application Developer's Guide:

Planning for delays

extern int pam_fail_delay(pam_handle_t *pamh, unsigned int micro_sec);

This function is offered by Linux-PAM to facilitate time delays following a failed call to pam_authenticate() and before control is returned to the application. When using this function the application programmer should check if it is available with,

#ifdef PAM_FAIL_DELAY
    ....
#endif /* PAM_FAIL_DELAY */

Generally, an application requests that a user is authenticated by Linux-PAM through a call to pam_authenticate() or pam_chauthtok(). These functions call each of the stacked authentication modules listed in the relevant Linux-PAM configuration file. As directed by this file, one of more of the modules may fail causing the pam_...() call to return an error. It is desirable for there to also be a pause before the application continues. The principal reason for such a delay is security: a delay acts to discourage brute force dictionary attacks primarily, but also helps hinder timed (covert channel) attacks.

Also this article gives more comprehensive information.

---

To remove/adjust the delay:

• The delay is probably caused by pam_faildelay.so

Check your pam configuration in /etc/pam.d/login using pam_faildelay e.g:

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

• Another source for the delay may be pam_unix.so

Edit /etc/pam.d/common-auth and add nodelay, e.g.,

auth    [success=1 default=ignore]      pam_unix.so nullok_secure

Changed to

auth    [success=1 default=ignore]      pam_unix.so nullok_secure nodelay

Note: For CentOS, RHEL and Fedora: you have to look for /etc/pam.d/system-auth

---

References:

• Why does it take longer to reject an invalid password than to accept a valid one?

• Why should checking a wrong password take longer than checking the right one?

• The Linux-PAM System Administrators' Guide

• Why is there a big delay after entering a wrong password?