Bug 57859 - password error delay reveals existing/non-existing accounts
Summary: password error delay reveals existing/non-existing accounts
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: openssh   
(Show other bugs)
Version: 7.2
Hardware: i686
OS: Linux
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Brian Brock
Depends On:
TreeView+ depends on / blocked
Reported: 2001-12-28 19:06 UTC by Florin Andrei
Modified: 2007-04-18 16:38 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-02-03 09:57:53 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Florin Andrei 2001-12-28 19:06:08 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.5) Gecko/20011014

Description of problem:
When you login by ssh to a host and the password fails, there's a small
delay before getting the password prompt again, which prevents bruteforce
But if you try to login to a non-existent username, the password prompt
returns immediately.
This allows remote attackers to guess usernames.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. ssh some-nonexistent-username@hostname
2. enter some bogus pass

Actual Results:  you get the password prompt again immediately

Expected Results:  there should be a delay before getting the prompt

Additional info:

tested on Red Hat 7.2 with openssh-3.0.2p1

Comment 1 Damien Miller 2001-12-30 07:23:47 UTC
> Expected Results:  there should be a delay before getting the prompt

Why slow down valid users? 

If anything, there should be no delay for invalid accounts, but this facilitates
password guessing.

Comment 2 Tomas Mraz 2005-02-03 09:57:53 UTC
In current Fedora Core (openssh-3.9p1) the non existing accounts give
the same delay as mistaken passwords on existing accounts.

Note You need to log in before you can comment on or make changes to this bug.