From: Stephen Frost <sfrost@snowman.net>
To: Craig James <cjames@emolecules.com>
Cc: Lukasz Brodziak <lukasz.brodziak@gmail.com>
Cc: Craig Ringer <craig@2ndquadrant.com>
Cc: Frank Cavaliero <fcavalie@us.ibm.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: Failed Login Attempts parameter
Date: Thu, 15 Nov 2012 19:45:11 -0500
Message-ID: <20121116004510.GD5162@tamriel.snowman.net> (raw)
In-Reply-To: <CAFwQ8reC+efJpQMhOB0n-BM1LJZy9=X4fgXTG44AUbbtgiubQA@mail.gmail.com>
References: <OF010D9AFE.7D96A308-ON85257AB6.00746957-85257AB6.0074746B@us.ibm.com>
<CAGWYGjUdhSoQr3xyd0bN1JbYcsg0rgZ2kDpMOKBJCPNKpXOemg@mail.gmail.com>
<50A4B42B.1090308@2ndQuadrant.com>
<CAGWYGjXvgiCJGZbjadzkTj-TuFLD=izSQe3ehuMAgpjOfntWYg@mail.gmail.com>
<CAFwQ8reC+efJpQMhOB0n-BM1LJZy9=X4fgXTG44AUbbtgiubQA@mail.gmail.com>
* Craig James (cjames@emolecules.com) wrote:
> A far better approach is an escalating delay. Check the number of failed
> login attempts N and delay (for example) N^2 seconds before responding
> again. Legitimate users are mildly inconvenienced, and hackers are
> severely hampered.
Sadly, in certain environments (US Federal organizations which are
required to follow FISMA), a lock-after-X-attempts control is required.
We dealt with this by utilizing the PAM authentication method with
pam_tally. It's kind of ugly, but it can be made to work. Other
alternatives are using Kerberos or Certificate-based authentication
where the user has to acquire initial credenials through some other
mechanism and then those have a limited time of usefulness (eg: Kerberos
tickets only last 10 hours). By using those credentials instead of
having database-based password requirements, you can avoid the entire
problem (along with password ageing, etc..).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 197B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, cjames@emolecules.com, lukasz.brodziak@gmail.com, craig@2ndquadrant.com, fcavalie@us.ibm.com
Subject: Re: Failed Login Attempts parameter
In-Reply-To: <20121116004510.GD5162@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox