|author||Steve Langasek <email@example.com>||2019-01-03 12:44:11 -0800|
|committer||Steve Langasek <firstname.lastname@example.org>||2019-01-03 12:44:11 -0800|
New upstream version 0.76
Diffstat (limited to 'doc/man/pam_fail_delay.3')
1 files changed, 0 insertions, 130 deletions
diff --git a/doc/man/pam_fail_delay.3 b/doc/man/pam_fail_delay.3
deleted file mode 100644
@@ -1,130 +0,0 @@
-.\" Hey Emacs! This file is -*- nroff -*- source.
-.\" Copyright (c) Andrew G. Morgan 1997 <email@example.com>
-.TH PAM_FAIL_DELAY 3 "1997 Jan 12" "Linux-PAM 0.56" "Programmers' Manual"
-pam_fail_delay \- request a delay on failure
-.B #include <security/pam_appl.h>
-.B #include <security/pam_modules.h>
-.BI "int pam_fail_delay(pam_handle_t " "*pamh" ", unsigned int " "usec" ");"
-It is often possible to attack an authentication scheme by exploiting
-the time it takes the scheme to deny access to an applicant user. In
-timeouts, it may prove possible to attempt a
-.I brute force
-dictionary attack -- with an automated process, the attacker tries all
-possible passwords to gain access to the system. In other cases,
-where individual failures can take measurable amounts of time
-(indicating the nature of the failure), an attacker can obtain useful
-information about the authentication process. These latter attacks
-make use of procedural delays that constitute a
-.I covert channel
-of useful information.
-To minimize the effectiveness of such attacks, it is desirable to
-introduce a random delay in a failed authentication process.
-provides such a facility. The delay occurs upon failure of the
-.BR pam_authenticate "(3) "
-.BR pam_chauthtok "(3) "
-functions. It occurs
-all authentication modules have been called, but
-control is returned to the service application.
-.BR pam_fail_delay "(3),"
-is used to specify a required minimum for the length of the
-argument. This function can be called by the service application
-and/or the authentication modules, both may have an interest in
-delaying a reapplication for service by the user. The length of the
-delay is computed at the time it is required. Its length is
-pseudo-gausianly distributed about the
-requested value; the resultant delay will differ by as much as 25% of
-this maximum requested value (both up and down).
-On return from
-.BR pam_authenticate "(3) or " pam_chauthtok "(3),"
-independent of success or failure, the new requested delay is reset to
-its default value: zero.
-For example, a
-application may require a failure delay of roughly 3 seconds. It will
-contain the following code:
-.B " pam_fail_delay(pamh, 3000000 /* micro-seconds */ );"
-.B " pam_authenticate(pamh, 0);"
-if the modules do not request a delay, the failure delay will be
-between 2.25 and 3.75 seconds.
-However, the modules, invoked in the authentication process, may
-also request delays:
-.RB " (module #1) " "pam_fail_delay(pamh, 2000000);"
-.RB " (module #2) " "pam_fail_delay(pamh, 4000000);"
-in this case, it is the largest requested value that is used to
-compute the actual failed delay: here between 3 and 5 seconds.
-.SH "RETURN VALUE"
-Following a successful call to
-.BR pam_fail_delay "(3), " PAM_SUCCESS
-is returned. All other returns should be considered serious failures.
-May be translated to text with
-.BR pam_strerror "(3). "
-.SH "CONFORMING TO"
-Under consideration by the X/Open group for future inclusion in the
-PAM RFC. 1996/1/10
-.SH "SEE ALSO"
-.BR pam_start "(3), "
-.BR pam_get_item "(3) "
-.BR pam_strerror "(3). "
-Also, see the three
-.BR "System administrators" ", "
-.BR "module developers" ", "
-.BR "application developers" ". "