path: root/doc/man/pam_fail_delay.3
diff options
authorSteve Langasek <>2019-01-03 12:44:11 -0800
committerSteve Langasek <>2019-01-03 12:44:11 -0800
commitefd31890b5ed496a5a00c08a262da240e66a4ddc (patch)
tree22a7aab22b3a491bb58df250d7d6409e0c160bcc /doc/man/pam_fail_delay.3
parent067affee9267fa0d1c21835182ba639ba33e820f (diff)
New upstream version 0.76
Diffstat (limited to 'doc/man/pam_fail_delay.3')
1 files changed, 0 insertions, 130 deletions
diff --git a/doc/man/pam_fail_delay.3 b/doc/man/pam_fail_delay.3
deleted file mode 100644
index f6cd238a..00000000
--- a/doc/man/pam_fail_delay.3
+++ /dev/null
@@ -1,130 +0,0 @@
-.\" Hey Emacs! This file is -*- nroff -*- source.
-.\" $Id$
-.\" Copyright (c) Andrew G. Morgan 1997 <>
-.TH PAM_FAIL_DELAY 3 "1997 Jan 12" "Linux-PAM 0.56" "Programmers' Manual"
-pam_fail_delay \- request a delay on failure
-.B #include <security/pam_appl.h>
-.B #include <security/pam_modules.h>
-.BI "int pam_fail_delay(pam_handle_t " "*pamh" ", unsigned int " "usec" ");"
-.sp 2
-It is often possible to attack an authentication scheme by exploiting
-the time it takes the scheme to deny access to an applicant user. In
-cases of
-.I short
-timeouts, it may prove possible to attempt a
-.I brute force
-dictionary attack -- with an automated process, the attacker tries all
-possible passwords to gain access to the system. In other cases,
-where individual failures can take measurable amounts of time
-(indicating the nature of the failure), an attacker can obtain useful
-information about the authentication process. These latter attacks
-make use of procedural delays that constitute a
-.I covert channel
-of useful information.
-To minimize the effectiveness of such attacks, it is desirable to
-introduce a random delay in a failed authentication process.
-.B Linux-PAM
-provides such a facility. The delay occurs upon failure of the
-.BR pam_authenticate "(3) "
-.BR pam_chauthtok "(3) "
-functions. It occurs
-.I after
-all authentication modules have been called, but
-.I before
-control is returned to the service application.
-The function,
-.BR pam_fail_delay "(3),"
-is used to specify a required minimum for the length of the
-failure-delay; the
-.I usec
-argument. This function can be called by the service application
-and/or the authentication modules, both may have an interest in
-delaying a reapplication for service by the user. The length of the
-delay is computed at the time it is required. Its length is
-pseudo-gausianly distributed about the
-.I maximum
-requested value; the resultant delay will differ by as much as 25% of
-this maximum requested value (both up and down).
-On return from
-.BR pam_authenticate "(3) or " pam_chauthtok "(3),"
-independent of success or failure, the new requested delay is reset to
-its default value: zero.
-For example, a
-.B login
-application may require a failure delay of roughly 3 seconds. It will
-contain the following code:
-.B " pam_fail_delay(pamh, 3000000 /* micro-seconds */ );"
-.B " pam_authenticate(pamh, 0);"
-if the modules do not request a delay, the failure delay will be
-between 2.25 and 3.75 seconds.
-However, the modules, invoked in the authentication process, may
-also request delays:
-.RB " (module #1) " "pam_fail_delay(pamh, 2000000);"
-.RB " (module #2) " "pam_fail_delay(pamh, 4000000);"
-in this case, it is the largest requested value that is used to
-compute the actual failed delay: here between 3 and 5 seconds.
-Following a successful call to
-.BR pam_fail_delay "(3), " PAM_SUCCESS
-is returned. All other returns should be considered serious failures.
-May be translated to text with
-.BR pam_strerror "(3). "
-Under consideration by the X/Open group for future inclusion in the
-PAM RFC. 1996/1/10
-.sp 2
-none known.
-.BR pam_start "(3), "
-.BR pam_get_item "(3) "
-.BR pam_strerror "(3). "
-Also, see the three
-.BR Linux-PAM
-Guides, for
-.BR "System administrators" ", "
-.BR "module developers" ", "
-.BR "application developers" ". "