<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Propose: make adjustments at login page to make difficult brute
force attack.<br>
<br>
Today, an intruder can make login tries without any action from
Wok.<br>
<br>
Possible measures:</p>
<p>Record source port and ip. After 3 tries, block user for 30
seconds and increase the time by each more try. Using source port
and ip will avoid errors for connections from NAT networks.<br>
<br>
Example:<br>
<br>
1) ip 192.168.1.1 tries to login as root 3 times and fail<br>
2) A timeout of 30 seconds will be set<br>
3) After that, for 5 minutes, each try will add 30 seconds + x
times the trial (60 seconds, 90 seconds. ..)</p>
<p>4) After 5 minutes of the last try, the counter will be reset.<br>
</p>
<pre class="moz-signature" cols="72">--
Ramon Nunes Medeiros
Kimchi Developer
Linux Technology Center Brazil
IBM Systems & Technology Group
Phone : +55 19 2132 7878
<a class="moz-txt-link-abbreviated" href="mailto:ramonn@br.ibm.com">ramonn@br.ibm.com</a> </pre>
</body>
</html>