10

Whenever I enter my password incorrectly upon login, there's a delay before I can try again. Why is this? Is there a way to remove the delay?

19

This is a security feature according to an explanation from another Stack Exchange community. Here are the two vulnerabilities solved by that feature:

  1. this (sic) throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk).

  2. If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to invalidate your credentials to help guess if part of your credentials were correct, dramatically reducing the guessing time.

As to whether you can remove the delay, no, but you can modify it to a minimum of 2 seconds according to this answer. Open the file /etc/login.defs and change the value set to FAIL_DELAY.

  • 3
    Thanks for the answer! Typically just linking is discouraged on StackExchange. Can you edit your post to contain the relevant information instead? :) – Daniel Foré Jul 20 '15 at 1:57
  • 1
    Oh, oops! sorry for being a novice and not having read more in the documentation before joining. Is the updated answer good now? – maliktunga Jul 20 '15 at 2:09
  • 1
    Brilliant answer! Thanks! I was asking myself the same question! – r3bl Jul 20 '15 at 8:31
  • No problem! And thanks to David Mulder for the improved format. – maliktunga Jul 21 '15 at 3:14
3

Short answer:

  • To reduce the rate of login attempt

  • To prevent quick brute forcing of passwords.

  • This makes it take longer to guess passwords.

  • Greatly increase security

Comprehensive:

It's actually to prevent brute force attacks from trying millions of passwords per second. The idea is to limit how fast passwords can be checked and there are a number of rules that should be followed.

  • A successful user/password pair should succeed immediately.

  • There should be no discernible difference in reasons for failure that can be detected.

Not even a time difference in response between the "invalid user and password" and "valid user but invalid password" failure reasons.

Every failure should deliver exactly the same information, textual and otherwise.

Some systems take it even further, increasing the delay with each failure, or only allowing three failures then having a massive delay before allowing a retry.

The general term for this behavior is tarpitting. (wikipedia much concentrated on Networking).

From The Linux-PAM Application Developer's Guide:

Planning for delays

extern int pam_fail_delay(pam_handle_t *pamh, unsigned int micro_sec);

This function is offered by Linux-PAM to facilitate time delays following a failed call to pam_authenticate() and before control is returned to the application. When using this function the application programmer should check if it is available with,

#ifdef PAM_FAIL_DELAY
    ....
#endif /* PAM_FAIL_DELAY */

Generally, an application requests that a user is authenticated by Linux-PAM through a call to pam_authenticate() or pam_chauthtok(). These functions call each of the stacked authentication modules listed in the relevant Linux-PAM configuration file. As directed by this file, one of more of the modules may fail causing the pam_...() call to return an error. It is desirable for there to also be a pause before the application continues. The principal reason for such a delay is security: a delay acts to discourage brute force dictionary attacks primarily, but also helps hinder timed (covert channel) attacks.

Also this article gives more comprehensive information.


To remove/adjust the delay:

Check your pam configuration in /etc/pam.d/login using pam_faildelay e.g:

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

Edit /etc/pam.d/common-auth and add nodelay, e.g.,

auth    [success=1 default=ignore]      pam_unix.so nullok_secure

Changed to

auth    [success=1 default=ignore]      pam_unix.so nullok_secure nodelay

Note: For CentOS, RHEL and Fedora: you have to look for /etc/pam.d/system-auth


References:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.