Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

faillock: Add a nodelay option #296

Merged
merged 1 commit into from Nov 12, 2020
Merged

faillock: Add a nodelay option #296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 10 additions & 0 deletions modules/pam_faillock/faillock.conf.5.xml
View file
Open in desktop
Expand Up @@ -94,6 +94,16 @@
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>nodelay</option>
</term>
<listitem>
<para>
Don't enforce a delay after authentication failures.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>deny=<replaceable>n</replaceable></option>
Expand Down
8 changes: 7 additions & 1 deletion modules/pam_faillock/pam_faillock.c
View file
Open in desktop
Expand Up @@ -67,6 +67,7 @@
#define FAILLOCK_FLAG_NO_LOG_INFO 0x8
#define FAILLOCK_FLAG_UNLOCKED 0x10
#define FAILLOCK_FLAG_LOCAL_ONLY 0x20
#define FAILLOCK_FLAG_NO_DELAY 0x40

#define MAX_TIME_INTERVAL 604800 /* 7 days */
#define FAILLOCK_CONF_MAX_LINELEN 1023
Expand Down Expand Up @@ -344,6 +345,9 @@ set_conf_opt(pam_handle_t *pamh, struct options *opts, const char *name, const c
else if (strcmp(name, "local_users_only") == 0) {
opts->flags |= FAILLOCK_FLAG_LOCAL_ONLY;
}
else if (strcmp(name, "nodelay") == 0) {
opts->flags |= FAILLOCK_FLAG_NO_DELAY;
}
else {
pam_syslog(pamh, LOG_ERR, "Unknown option: %s", name);
}
Expand Down Expand Up @@ -654,7 +658,9 @@ pam_sm_authenticate(pam_handle_t *pamh, int flags,
if (rv != PAM_SUCCESS)
goto err;

pam_fail_delay(pamh, 2000000); /* 2 sec delay on failure */
if (!(opts.flags & FAILLOCK_FLAG_NO_DELAY)) {
pam_fail_delay(pamh, 2000000); /* 2 sec delay on failure */
}

if ((rv=get_pam_user(pamh, &opts)) != PAM_SUCCESS) {
goto err;
Expand Down