[Date Prev][Date Next]
(ITS#5911) password policy - alternate lockout mechanism
Full_Name: Aravind Gottipati
OS: Linux - RHEL5
Submission from: (NULL) (220.127.116.11)
I'd like to propose a change to how the password lockouts work. The current
system does not differentiate between multiple bind attempts with a single (or
even a few) incorrect password(s) vs. multiple bind attempts with different
In our case, this results in a ton of false positives when folks change their
password, but don't propagate their password change to all the
applications/machines that use it. This causes a bunch of un-necessary
lockouts. A real crack attempt on the other hand would most likely try a bunch
of passwords (none of which repeat).
I have posted the same on the openldap-software mailing lists and Jeff Clowser
proposed a scheme that should work to solve the problem.
Record each failed bind attempt as a (hash,timestamp) pair. If there is another
failed attempt, check the password against these (hash, timestamp) pairs and
update the timestamp if the hash is found. If its a new password that hasn't
been attempted before, then create a new (hash,timestamp) pair. Lock the
account out if there are more than pwdMaxFailure hashes stored.