pub struct AuthFailures { /* private fields */ }Expand description
The authentication failures one connection has run up, in buckets.
Which bucket a failure lands in is what makes clearing them on success
honest. auth.users is a list, so a peer can hold one valid credential and
guess at another user’s password with it: with one counter cleared by any
success, it interleaves a good request between guesses and never reaches
max_auth_failures. One counter per user-id guessed at closes that, and
leaves the case the clearing exists for — one client, one credential, an app
that drops the header now and then — exactly as it was.
A single run charged to the first failure that named somebody was the earlier answer and was not enough: the peer opens each cycle with a deliberate failure as itself, which claims the run, and its success as itself then clears the whole thing, guesses at everybody else included.
The cap is on the total across the buckets, not on any one of them. A
per-bucket cap would hand a guesser max_auth_failures - 1 free guesses for
every configured user rather than that many for the whole connection.
One connection holds at most |configured users| + 2 counters, and every key
is a copy of a name from the configuration file, so a peer cannot grow this
by inventing user-ids however many it invents.