Dan White wrote:
I'd only want a delay when a user/attacker has entered a bad password, similar to the way a UNIX shell introduces a delay. My concern is that the faster I tune my server, the more likely it will become that an attacker will brute force a password.
Given the current implementation, the delay will keep a thread busy for its duration. Your server, under attack, would quickly become unresponsive for any user. Probably, your case should be handled separately, e.g. by writing an overlay that registers a delay for a given connection and quicly releases the operation, and a background thread that wakes up when it's time to return errors after the delay. Nothing dramatic, but definitely needs some development.
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati@sys-net.it ---------------------------------------