ldm 3.2.0-1

Lockout warnings in the greeter.

Sites protect RDP with fail2ban, so a few wrong passwords block the client at
the network level for some minutes. From the seat that is baffling, and it
cannot be explained by asking the server - being unable to reach the server is
the state in question. This release lets the greeter warn before it happens
and say how long the block has left once it has.

What ldm can honestly observe was measured, not assumed. Against xrdp a
rejected password makes the RDP client neither exit nor report anything: the
session stays open showing xrdp's own login window, and the retries happen in
there, invisible to ldm. Failed RDP logins are therefore not countable from
the client at all. The optional pre-authentication is the one place a
rejection is visible, so that is where the counting happens.

Those rejections are worth counting even though a rejected pre-auth never
reaches the RDP server, because they reach something else that counts them.
RDP_PREAUTH=ssh leaves a failed password in the sshd log, where an sshd jail
bans the client - with banaction_allports, on every port. RDP_PREAUTH=krb5
raises badPwdCount on the domain controller, where the account lockout
policy is counting.

New in lts.conf

Setting	Meaning	Default
RDP_PREAUTH_MAXFAIL	rejections before the client counts itself blocked	0 (off)
RDP_PREAUTH_FAILWINDOW	seconds over which they count	600
RDP_PREAUTH_LOCKTIME	how long the block lasts, for the countdown	600

Off by default on purpose: the right number is whatever the site configured on
the server, and a warning about a lockout that does not exist is worse than
silence.

The tally lives in /run/ldm/lockout and is shared by every screen on the
client. That is the point rather than an implementation detail - SCREEN_05
through SCREEN_08 are four greeters behind one address and the jail counts per
address, so a per-process counter would see a quarter of what the server sees.

Also

The pre-auth backends now report a verdict alongside the message, so "wrong
password" and "cannot reach the server" are told apart by something other than
inspecting a translated string. An account already locked, or whose password
expired, is reported as barred rather than rejected - neither is a failed
attempt.

Installing

These .deb files are the same ones in the signed apt archive, which is the
easier route:

https://mabutz.github.io/ltsp6  trixie main

Requires ltsp-client-core 6.2.1-1 or newer for the documentation of the new
settings.