Whenever I enter my password incorrectly upon login, there's a delay before I can try again. Why is this? Is there a way to remove the delay?
This is a security feature according to an explanation from another Stack Exchange community. Here are the two vulnerabilities solved by that feature:
this (sic) throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk).
If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to invalidate your credentials to help guess if part of your credentials were correct, dramatically reducing the guessing time.
As to whether you can remove the delay, no, but you can modify it to a minimum of 2 seconds according to this answer. Open the file
/etc/login.defs and change the value set to
To reduce the rate of login attempt
To prevent quick brute forcing of passwords.
This makes it take longer to guess passwords.
Greatly increase security
It's actually to prevent brute force attacks from trying millions of passwords per second. The idea is to limit how fast passwords can be checked and there are a number of rules that should be followed.
A successful user/password pair should succeed immediately.
There should be no discernible difference in reasons for failure that can be detected.
Not even a time difference in response between the "invalid user and password" and "valid user but invalid password" failure reasons.
Every failure should deliver exactly the same information, textual and otherwise.
Some systems take it even further, increasing the delay with each failure, or only allowing three failures then having a massive delay before allowing a retry.
The general term for this behavior is tarpitting. (wikipedia much concentrated on Networking).
From The Linux-PAM Application Developer's Guide:
Planning for delays
extern int pam_fail_delay(pam_handle_t *pamh, unsigned int micro_sec);
This function is offered by Linux-PAM to facilitate time delays following a failed call to pam_authenticate() and before control is returned to the application. When using this function the application programmer should check if it is available with,
#ifdef PAM_FAIL_DELAY .... #endif /* PAM_FAIL_DELAY */
Generally, an application requests that a user is authenticated by Linux-PAM through a call to pam_authenticate() or pam_chauthtok(). These functions call each of the stacked authentication modules listed in the relevant Linux-PAM configuration file. As directed by this file, one of more of the modules may fail causing the pam_...() call to return an error. It is desirable for there to also be a pause before the application continues. The principal reason for such a delay is security: a delay acts to discourage brute force dictionary attacks primarily, but also helps hinder timed (covert channel) attacks.
Also this article gives more comprehensive information.
To remove/adjust the delay:
- The delay is probably caused by
Check your pam configuration in
# Enforce a minimal delay in case of failure (in microseconds). # (Replaces the `FAIL_DELAY' setting from login.defs) # Note that other modules may require another minimal delay. (for example, # to disable any delay, you should add the nodelay option to pam_unix) auth optional pam_faildelay.so delay=3000000
- Another source for the delay may be
/etc/pam.d/common-auth and add nodelay, e.g.,
auth [success=1 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_unix.so nullok_secure nodelay
Note: For CentOS, RHEL and Fedora: you have to look for