ProFtpd Login Wait

Seregwethrin · 05-21-2009, 01:46 PM

Hello;

I want to put a waiting time interval on login. Can I do that?

For example after sending the user and password data, I want user to wait about 10 seconds.

My purpose with this is to make hard brute force attacks.

bathory · 05-21-2009, 02:15 PM

I'm afraid that this is not possible.
But proftpd uses mod_delay that by default delays each login for an arbitrary amount of time (measured in usecs) that makes difficult the brute force attacks.

Seregwethrin · 05-21-2009, 02:35 PM

Well, It didn't make any difference. Tried so many times with different combinations also with restarting the service but nope...

bathory · 05-21-2009, 02:57 PM

usecs are microseconds, so you can't see any difference. It you have enable trace you should see something like:

Quote:

May 21 22:47:26 [29053] <delay:8>: adding 816 usecs to USER row
May 21 22:47:26 [29053] <delay:8>: unlocking DelayTable '/usr/local/var/proftpd/proftpd.delay', row 1
May 21 22:47:27 [29053] <delay:8>: adding 1612 usecs to PASS row
May 21 22:47:27 [29053] <delay:8>: unlocking DelayTable '/usr/local/var/proftpd/proftpd.delay', row 2
May 21 22:47:27 [29053] <delay:8>: additional random delay of 27244 usecs added
May 21 22:47:27 [29053] <delay:8>: delaying for 115885 usecs
May 21 22:47:34 [29053] <delay:8>: adding 423 usecs to USER row
May 21 22:47:34 [29053] <delay:8>: unlocking DelayTable '/usr/local/var/proftpd/proftpd.delay', row 1
May 21 22:47:35 [29053] <delay:8>: adding 1481 usecs to PASS row
May 21 22:47:35 [29053] <delay:8>: unlocking DelayTable '/usr/local/var/proftpd/proftpd.delay', row 2
May 21 22:47:35 [29053] <delay:8>: additional random delay of 6301 usecs added
May 21 22:47:35 [29053] <delay:8>: delaying for 50210 usecs

So as you see the time between subsequent logins is random, thus making difficult the brute force attacks.

Seregwethrin · 05-21-2009, 03:01 PM

Than it provides some security increment. Thanks, I'll use it.

But I guess we can't change the usecs interval or minimum, right?

bathory · 05-21-2009, 03:17 PM

You guessed right...
But if you are a programmer, you can patch/edit mod_delay.c to add a minimum delay time.

Regards