Skip to content

Unable to limit failed publickey authentication attempts. #824

@tjko

Description

@tjko

I noticed that there doesn't seem to be any way to limit (failed) public key authentication attempts. Which could be a security issue.

Seems like only way currently to limit authentication attempts (similar fashion to OpenSSH MaxAuthTries configuration option), is for user authentication callback function to implement counting failed attempts and send WOLFSSH_USERAUTH_REJECTED when it determines too many attempts has been made?

When implementing limit on failed authentication attempts via "userAuthCb" callback function, I noticed this didn't work on public keys (potential attacker could try unlimited number of public keys), while it worked fine for password authentication attempts...

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions