Bug 57859 - password error delay reveals existing/non-existing accounts
Summary: password error delay reveals existing/non-existing accounts
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: openssh
Version: 7.2
Hardware: i686
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Brian Brock
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2001-12-28 19:06 UTC by Florin Andrei
Modified: 2007-04-18 16:38 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2005-02-03 09:57:53 UTC
Embargoed:


Attachments (Terms of Use)

Description Florin Andrei 2001-12-28 19:06:08 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.5) Gecko/20011014

Description of problem:
When you login by ssh to a host and the password fails, there's a small
delay before getting the password prompt again, which prevents bruteforce
attacks.
But if you try to login to a non-existent username, the password prompt
returns immediately.
This allows remote attackers to guess usernames.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. ssh some-nonexistent-username@hostname
2. enter some bogus pass
3.
	

Actual Results:  you get the password prompt again immediately

Expected Results:  there should be a delay before getting the prompt

Additional info:

tested on Red Hat 7.2 with openssh-3.0.2p1

Comment 1 Damien Miller 2001-12-30 07:23:47 UTC
> Expected Results:  there should be a delay before getting the prompt

Why slow down valid users? 

If anything, there should be no delay for invalid accounts, but this facilitates
password guessing.

Comment 2 Tomas Mraz 2005-02-03 09:57:53 UTC
In current Fedora Core (openssh-3.9p1) the non existing accounts give
the same delay as mistaken passwords on existing accounts.



Note You need to log in before you can comment on or make changes to this bug.