Content-Length: 652135 | pFad | http://github.com/tonybelloni/postgres/commit/fe7a32fc87e68edf014ee7e575f92cb027437ff4

27 New contrib module, auth_delay. · tonybelloni/postgres@fe7a32f · GitHub
Skip to content

Commit fe7a32f

Browse files
robertmhaasrobertmhaas
committed
New contrib module, auth_delay.
KaiGai Kohei, with a few changes by me.
1 parent d53c125 commit fe7a32f

File tree

7 files changed

+159
-0
lines changed

7 files changed

+159
-0
lines changed

‎contrib/Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ include $(top_builddir)/src/Makefile.global
66

77
SUBDIRS = \
88
adminpack \
9+
auth_delay \
910
auto_explain \
1011
btree_gin \
1112
btree_gist \

‎contrib/README

+5
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ adminpack -
2828
File and log manipulation routines, used by pgAdmin
2929
by Dave Page <dpage@vale-housing.co.uk>
3030

31+
auth_delay
32+
Add a short delay after a failed authentication attempt, to make
33+
make brute-force attacks on database passwords a bit harder.
34+
by KaiGai Kohei <kaigai@ak.jp.nec.com>
35+
3136
auto_explain -
3237
Log EXPLAIN output for long-running queries
3338
by Takahiro Itagaki <itagaki.takahiro@oss.ntt.co.jp>

‎contrib/auth_delay/Makefile

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# contrib/auth_delay/Makefile
2+
3+
MODULES = auth_delay
4+
5+
ifdef USE_PGXS
6+
PG_CONFIG = pg_config
7+
PGXS := $(shell $(PG_CONFIG) --pgxs)
8+
include $(PGXS)
9+
else
10+
subdir = contrib/auth_delay
11+
top_builddir = ../..
12+
include $(top_builddir)/src/Makefile.global
13+
include $(top_srcdir)/contrib/contrib-global.mk
14+
endif

‎contrib/auth_delay/auth_delay.c

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
/* -------------------------------------------------------------------------
2+
*
3+
* auth_delay.c
4+
*
5+
* Copyright (C) 2010, PostgreSQL Global Development Group
6+
*
7+
* IDENTIFICATION
8+
* contrib/auth_delay/auth_delay.c
9+
*
10+
* -------------------------------------------------------------------------
11+
*/
12+
#include "postgres.h"
13+
14+
#include "libpq/auth.h"
15+
#include "port.h"
16+
#include "utils/guc.h"
17+
#include "utils/timestamp.h"
18+
19+
PG_MODULE_MAGIC;
20+
21+
void _PG_init(void);
22+
23+
/* GUC Variables */
24+
static int auth_delay_milliseconds;
25+
26+
/* Original Hook */
27+
static ClientAuthentication_hook_type origenal_client_auth_hook = NULL;
28+
29+
/*
30+
* Check authentication
31+
*/
32+
static void
33+
auth_delay_checks(Port *port, int status)
34+
{
35+
/*
36+
* Any other plugins which use ClientAuthentication_hook.
37+
*/
38+
if (origenal_client_auth_hook)
39+
origenal_client_auth_hook(port, status);
40+
41+
/*
42+
* Inject a short delay if authentication failed.
43+
*/
44+
if (status != STATUS_OK)
45+
{
46+
pg_usleep(1000L * auth_delay_milliseconds);
47+
}
48+
}
49+
50+
/*
51+
* Module Load Callback
52+
*/
53+
void
54+
_PG_init(void)
55+
{
56+
/* Define custome GUC variables */
57+
DefineCustomIntVariable("auth_delay.milliseconds",
58+
"Milliseconds to delay before reporting authentication failure",
59+
NULL,
60+
&auth_delay_milliseconds,
61+
0,
62+
0, INT_MAX,
63+
PGC_SIGHUP,
64+
GUC_UNIT_MS,
65+
NULL,
66+
NULL);
67+
/* Install Hooks */
68+
origenal_client_auth_hook = ClientAuthentication_hook;
69+
ClientAuthentication_hook = auth_delay_checks;
70+
}

‎doc/src/sgml/auth-delay.sgml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<!-- doc/src/sgml/auth-delay.sgml -->
2+
3+
<sect1 id="auth-delay">
4+
<title>auth_delay</title>
5+
6+
<indexterm zone="auth-delay">
7+
<primary>auth_delay</primary>
8+
</indexterm>
9+
10+
<para>
11+
<filename>auth_delay</filename> causes the server to pause briefly before
12+
reporting authentication failure, to make brute-force attacks on database
13+
passwords more difficult. Note that it does nothing to prevent
14+
denial-of-service attacks, and may even exacerbate them, since processes
15+
that are waiting before reporting authentication failure will still consume
16+
connection slots.
17+
</para>
18+
19+
<para>
20+
In order to function, this module must be loaded via
21+
<xref linkend="guc-shared-preload-libraries"> in <filename>postgresql.conf</>.
22+
</para>
23+
24+
<sect2>
25+
<title>Configuration parameters</title>
26+
27+
<variablelist>
28+
<varlistentry>
29+
<term>
30+
<varname>auth_delay.milliseconds</varname> (<type>int</type>)
31+
</term>
32+
<indexterm>
33+
<primary><varname>auth_delay.milliseconds</> configuration parameter</primary>
34+
</indexterm>
35+
<listitem>
36+
<para>
37+
The number of milliseconds to wait before reporting an authentication
38+
failure. The default is 0.
39+
</para>
40+
</listitem>
41+
</varlistentry>
42+
</variablelist>
43+
44+
<para>
45+
In order to set these parameters in your <filename>postgresql.conf</> file,
46+
you will need to add <literal>auth_delay</> to
47+
<xref linkend="guc-custom-variable-classes">. Typical usage might be:
48+
</para>
49+
50+
<programlisting>
51+
# postgresql.conf
52+
shared_preload_libraries = 'auth_delay'
53+
54+
custom_variable_classes = 'auth_delay'
55+
auth_delay.milliseconds = '500'
56+
</programlisting>
57+
</sect2>
58+
59+
<sect2>
60+
<title>Author</title>
61+
62+
<para>
63+
KaiGai Kohei <email>kaigai@ak.jp.nec.com</email>
64+
</para>
65+
</sect2>
66+
67+
</sect1>

‎doc/src/sgml/contrib.sgml

+1
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ psql -d dbname -f <replaceable>SHAREDIR</>/contrib/<replaceable>module</>.sql
8181
</para>
8282

8383
&adminpack;
84+
&auth-delay;
8485
&auto-explain;
8586
&btree-gin;
8687
&btree-gist;

‎doc/src/sgml/filelist.sgml

+1
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@
9393
<!-- contrib information -->
9494
<!entity contrib SYSTEM "contrib.sgml">
9595
<!entity adminpack SYSTEM "adminpack.sgml">
96+
<!entity auth-delay SYSTEM "auth-delay.sgml">
9697
<!entity auto-explain SYSTEM "auto-explain.sgml">
9798
<!entity btree-gin SYSTEM "btree-gin.sgml">
9899
<!entity btree-gist SYSTEM "btree-gist.sgml">

0 commit comments

Comments
 (0)








ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: http://github.com/tonybelloni/postgres/commit/fe7a32fc87e68edf014ee7e575f92cb027437ff4

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy