* [kbd] [PATCH 3/3] vlock: introduce short delays after non-fatal PAM errors
@ 2013-11-24 21:48 Dmitry V. Levin
0 siblings, 0 replies; only message in thread
From: Dmitry V. Levin @ 2013-11-24 21:48 UTC (permalink / raw)
To: kbd
Add a short delay after PAM errors like PAM_AUTH_ERR that are likely
to be non-fatal, so that in case when they are fatal, there would be
a delay between continuous attempts that are doomed to fail.
For example, fatal PAM configuration errors like unreadable
/etc/pam.d/vlock file usually result to immediate PAM_AUTH_ERR,
the same error as returned by more likely authentication error
due to incorrect password.
---
src/vlock/auth.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/vlock/auth.c b/src/vlock/auth.c
index 76945c0..da135ce 100644
--- a/src/vlock/auth.c
+++ b/src/vlock/auth.c
@@ -35,6 +35,8 @@
/* Delay after fatal PAM errors, in seconds. */
#define LONG_DELAY 10
+/* Delay after other PAM errors, in seconds. */
+#define SHORT_DELAY 1
static int
do_account_password_management (pam_handle_t *pamh)
@@ -117,6 +119,7 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
fflush (stdout);
pam_end (pamh, rc);
pamh = 0;
+ sleep (SHORT_DELAY);
break;
}
@@ -135,7 +138,7 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
if (is_vt || isatty (STDIN_FILENO))
{
/* Ignore error. */
- sleep (1);
+ sleep (SHORT_DELAY);
break;
}
@@ -162,6 +165,7 @@ get_password (pam_handle_t * pamh, const char *username, const char *tty)
default:
printf ("%s.\n\n\n", pam_strerror (pamh, rc));
fflush (stdout);
+ sleep (SHORT_DELAY);
}
}
}
--
ldv
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-11-24 21:48 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-11-24 21:48 [kbd] [PATCH 3/3] vlock: introduce short delays after non-fatal PAM errors Dmitry V. Levin
Linux console tools development discussion
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/kbd/0 kbd/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 kbd kbd/ http://lore.altlinux.org/kbd \
kbd@lists.altlinux.org kbd@lists.altlinux.ru kbd@lists.altlinux.com
public-inbox-index kbd
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.kbd
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git