-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
rhel-9.2.0
-
None
-
Moderate
-
rhel-sst-idm-sssd
-
ssg_idm
-
None
-
False
-
-
None
-
Red Hat Enterprise Linux
-
None
-
All
-
None
When you use `sudo` but get your password wrong there an approximately 2 second delay (it's actually randomised a bit).
This serves no security purpose. In theory it would prevent dictionary attacks against your own password if an attack has access to your account. However that's nonsense for two reasons:
- If an attacker has access to your account it's completely trivial to get your password - just alias `sudo` to `mitm_sudo` and wait.
- You can check the current user's password using `unix_chkpwd` (which is how PAM does it). That program has no delay at all.
Therefore all the delay does is give a very annoying illusion of security.
Please can you disable the delay? I believe this can be done by removing this line in `/etc/pam.d/system-auth`:
auth required pam_faildelay.so delay=2000000
It may make sense to keep the delay for local logins but not sudo. I'm not entirely sure how the `pam.d` configs work, but there is a `sudo` file in there (and also `sudo-i`?) so maybe that is possible.