Received: from makus.postgresql.org ([98.129.198.125])
	by malur.postgresql.org with esmtp (Exim 4.72)
	(envelope-from <sfrost@tamriel.snowman.net>) id 1TZA3W-0002yD-0O
	for pgsql-admin@postgresql.org; Fri, 16 Nov 2012 00:45:14 +0000
Received: from tamriel.snowman.net ([72.66.115.51])
	by makus.postgresql.org with esmtp (Exim 4.72)
	(envelope-from <sfrost@tamriel.snowman.net>) id 1TZA3U-0004rD-58
	for pgsql-admin@postgresql.org; Fri, 16 Nov 2012 00:45:13 +0000
Received: by tamriel.snowman.net (Postfix, from userid 1000)
	id 238B5231B2; Thu, 15 Nov 2012 19:45:11 -0500 (EST)
Date: Thu, 15 Nov 2012 19:45:11 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Craig James <cjames@emolecules.com>
Cc: Lukasz Brodziak <lukasz.brodziak@gmail.com>,
	Craig Ringer <craig@2ndquadrant.com>,
	Frank Cavaliero <fcavalie@us.ibm.com>, pgsql-admin@postgresql.org
Subject: Re: Failed Login Attempts parameter
Message-ID: <20121116004510.GD5162@tamriel.snowman.net>
References: 
 <OF010D9AFE.7D96A308-ON85257AB6.00746957-85257AB6.0074746B@us.ibm.com>
	<CAGWYGjUdhSoQr3xyd0bN1JbYcsg0rgZ2kDpMOKBJCPNKpXOemg@mail.gmail.com>
	<50A4B42B.1090308@2ndQuadrant.com>
	<CAGWYGjXvgiCJGZbjadzkTj-TuFLD=izSQe3ehuMAgpjOfntWYg@mail.gmail.com>
	<CAFwQ8reC+efJpQMhOB0n-BM1LJZy9=X4fgXTG44AUbbtgiubQA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="9G1N7tM9L3K453BF"
Content-Disposition: inline
In-Reply-To: 
 <CAFwQ8reC+efJpQMhOB0n-BM1LJZy9=X4fgXTG44AUbbtgiubQA@mail.gmail.com>
X-Editor: Vim http://www.vim.org/
X-Info: http://www.snowman.net
X-Operating-System: Linux/3.2.0-4-amd64 (x86_64)
X-Uptime: 19:41:46 up 21 days, 23:05, 10 users,  load average: 0.04, 0.19,
 0.22
User-Agent: Mutt/1.5.21 (2010-09-15)
X-Pg-Spam-Score: -2.0 (--)
X-Archive-Number: 201211/86
X-Sequence-Number: 40331


--9G1N7tM9L3K453BF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

* Craig James (cjames@emolecules.com) wrote:
> A far better approach is an escalating delay. Check the number of failed
> login attempts N and delay (for example) N^2 seconds before responding
> again.  Legitimate users are mildly inconvenienced, and hackers are
> severely hampered.

Sadly, in certain environments (US Federal organizations which are
required to follow FISMA), a lock-after-X-attempts control is required.

We dealt with this by utilizing the PAM authentication method with
pam_tally.  It's kind of ugly, but it can be made to work.  Other
alternatives are using Kerberos or Certificate-based authentication
where the user has to acquire initial credenials through some other
mechanism and then those have a limited time of usefulness (eg: Kerberos
tickets only last 10 hours).  By using those credentials instead of
having database-based password requirements, you can avoid the entire
problem (along with password ageing, etc..).

	Thanks,

		Stephen

--9G1N7tM9L3K453BF
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlCljJYACgkQrzgMPqB3kiiOYgCgmduKbJgcvWitjgDeqGzuiuKw
xREAn2K2jAFRICC7mYhMIQZOFg8H1uWG
=4uzs
-----END PGP SIGNATURE-----

--9G1N7tM9L3K453BF--