http://bugzilla.novell.com/show_bug.cgi?id=550660 User jreidinger@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=550660#c1 Josef Reidinger changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO CC| |jreidinger@novell.com Info Provider| |kkaempf@novell.com --- Comment #1 from Josef Reidinger 2009-10-29 05:05:08 MDT --- I think about it and for me the simplest solution is to have sleep during failed login and singleton counter, which counts fail login attemp and if number is above specified border, then disallow login. Because it should allow normal user to login, it should be time limited. So fail attemp has also last failed attemp and if it is more then e.g. 10 minutes, then clear counter. Also disallow logging should be only for limited time e.g. 10 minutes. So if we set borders to 5 failed attempts and 10 minutes, then attacker could try 720 password per day, which is useless for brutal-force attack. Klaus - what do you think? If you agree I can implement it. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.