[Bug 1628926] Re: Postpone login attempts if X successive attempts have failed

[johnmne]

@Robie Basak (racb):

OK, though having a good default values impacts greatly on the security
of systems world-wide.

Normal users just install a software but don't configure.
This encourages hackers to attempt to hack users world-wide.
If hackers knew that a good default configurations are present by default (which greatly prevents attempts of brute-forcing) to everyone, then they will probably give up before trying...

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1628926

Title:
  Postpone login attempts if X successive attempts have failed

Status in openssh package in Ubuntu:
  Won't Fix

Bug description:
  ** This is a feature request that regards to security. **

  Please add to the login method a mechanism that postpones successive
  login attempts if X attempts have failed.

  Obviously this can be further enhanced - for example:
  If X successive login attempts failed, then disable that specific login method for that specific user for Y minutes.
  If Y minutes have passed and the additional successive attempts failed again - then disable that specific login method for that specific user for 2*Y minutes.
  And so on... 

  Values of X and Y should be configured by the 'root' user.

  Benefits: greatly reduces the risk of remotely brute-forcing the
  password.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1628926/+subscriptions