Re: [phplib] Disallowing infinite incorrect passwords From: Kristian Koehntopp (kris <email protected>)
Date: 04/27/00

In netuse.lists.phplib you write:
>Well, I guess this could be done, but the conditions would be very
>restrictive. How do You intend to catch a user (I mean a real world user
>- a human - not a login) who's trying to crack someone's password?

You are dealing with users who have not successfully
authenticated themselves here, so you cannot actually do
something with that users - they may not even be users in the
sense that they have a valid account on your system. The only
thing you have on your system is the account they try to break
into.

What you would do to implement this kind of security mechanism
is

- extend the auth_users table with a field "p_inv_login"
  or something, which you set to zero. Each time an
  authentication attempt succeeds for that login, you reset that
  field to zero. Each time an authentication attempt fails for
  that login, you increment that field. These operations have to
  be done in your Auth::auth_validatelogin() function.

- Auth::auth_validatelogin() will return false, if the
  p_inv_login is larger than a configureable limit and
  p_perm is not a special superuser permission (this is
  done so that administrator accounts cannot be locked
  out).

Implementing this mechanism opens you to denial of service
against all accounts where the account name is publicly known.

You will probably want to implement an alert mechanism which
sends mail to an administrator informing them about the account
locking as soon as some p_inv_login crosses the boundary.

Also, you will probably want to create a kind of wtmp table,
which can be used as an auditing trail for logins, recoding ip
numbers, user agent identifiers, times and other information
relevant to a user authentication.

Kristian

---------------------------------------------------------------------
To unsubscribe, e-mail: phplib-unsubscribe <email protected>
For additional commands, e-mail: phplib-help <email protected>