Skip to content

Commit fe7a32f

Browse files
robertmhaasrobertmhaas
committed
New contrib module, auth_delay.
KaiGai Kohei, with a few changes by me.
1 parent d53c125 commit fe7a32f

File tree

7 files changed

+159
-0
lines changed

7 files changed

+159
-0
lines changed

‎contrib/Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ include $(top_builddir)/src/Makefile.global
66

77
SUBDIRS = \
88
adminpack \
9+
auth_delay \
910
auto_explain \
1011
btree_gin \
1112
btree_gist \

‎contrib/README

+5
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ adminpack -
2828
File and log manipulation routines, used by pgAdmin
2929
by Dave Page <dpage@vale-housing.co.uk>
3030

31+
auth_delay
32+
Add a short delay after a failed authentication attempt, to make
33+
make brute-force attacks on database passwords a bit harder.
34+
by KaiGai Kohei <kaigai@ak.jp.nec.com>
35+
3136
auto_explain -
3237
Log EXPLAIN output for long-running queries
3338
by Takahiro Itagaki <itagaki.takahiro@oss.ntt.co.jp>

‎contrib/auth_delay/Makefile

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# contrib/auth_delay/Makefile
2+
3+
MODULES = auth_delay
4+
5+
ifdef USE_PGXS
6+
PG_CONFIG = pg_config
7+
PGXS := $(shell $(PG_CONFIG) --pgxs)
8+
include $(PGXS)
9+
else
10+
subdir = contrib/auth_delay
11+
top_builddir = ../..
12+
include $(top_builddir)/src/Makefile.global
13+
include $(top_srcdir)/contrib/contrib-global.mk
14+
endif

‎contrib/auth_delay/auth_delay.c

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
/* -------------------------------------------------------------------------
2+
*
3+
* auth_delay.c
4+
*
5+
* Copyright (C) 2010, PostgreSQL Global Development Group
6+
*
7+
* IDENTIFICATION
8+
* contrib/auth_delay/auth_delay.c
9+
*
10+
* -------------------------------------------------------------------------
11+
*/
12+
#include "postgres.h"
13+
14+
#include "libpq/auth.h"
15+
#include "port.h"
16+
#include "utils/guc.h"
17+
#include "utils/timestamp.h"
18+
19+
PG_MODULE_MAGIC;
20+
21+
void _PG_init(void);
22+
23+
/* GUC Variables */
24+
static int auth_delay_milliseconds;
25+
26+
/* Original Hook */
27+
static ClientAuthentication_hook_type original_client_auth_hook = NULL;
28+
29+
/*
30+
* Check authentication
31+
*/
32+
static void
33+
auth_delay_checks(Port *port, int status)
34+
{
35+
/*
36+
* Any other plugins which use ClientAuthentication_hook.
37+
*/
38+
if (original_client_auth_hook)
39+
original_client_auth_hook(port, status);
40+
41+
/*
42+
* Inject a short delay if authentication failed.
43+
*/
44+
if (status != STATUS_OK)
45+
{
46+
pg_usleep(1000L * auth_delay_milliseconds);
47+
}
48+
}
49+
50+
/*
51+
* Module Load Callback
52+
*/
53+
void
54+
_PG_init(void)
55+
{
56+
/* Define custome GUC variables */
57+
DefineCustomIntVariable("auth_delay.milliseconds",
58+
"Milliseconds to delay before reporting authentication failure",
59+
NULL,
60+
&auth_delay_milliseconds,
61+
0,
62+
0, INT_MAX,
63+
PGC_SIGHUP,
64+
GUC_UNIT_MS,
65+
NULL,
66+
NULL);
67+
/* Install Hooks */
68+
original_client_auth_hook = ClientAuthentication_hook;
69+
ClientAuthentication_hook = auth_delay_checks;
70+
}

‎doc/src/sgml/auth-delay.sgml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<!-- doc/src/sgml/auth-delay.sgml -->
2+
3+
<sect1 id="auth-delay">
4+
<title>auth_delay</title>
5+
6+
<indexterm zone="auth-delay">
7+
<primary>auth_delay</primary>
8+
</indexterm>
9+
10+
<para>
11+
<filename>auth_delay</filename> causes the server to pause briefly before
12+
reporting authentication failure, to make brute-force attacks on database
13+
passwords more difficult. Note that it does nothing to prevent
14+
denial-of-service attacks, and may even exacerbate them, since processes
15+
that are waiting before reporting authentication failure will still consume
16+
connection slots.
17+
</para>
18+
19+
<para>
20+
In order to function, this module must be loaded via
21+
<xref linkend="guc-shared-preload-libraries"> in <filename>postgresql.conf</>.
22+
</para>
23+
24+
<sect2>
25+
<title>Configuration parameters</title>
26+
27+
<variablelist>
28+
<varlistentry>
29+
<term>
30+
<varname>auth_delay.milliseconds</varname> (<type>int</type>)
31+
</term>
32+
<indexterm>
33+
<primary><varname>auth_delay.milliseconds</> configuration parameter</primary>
34+
</indexterm>
35+
<listitem>
36+
<para>
37+
The number of milliseconds to wait before reporting an authentication
38+
failure. The default is 0.
39+
</para>
40+
</listitem>
41+
</varlistentry>
42+
</variablelist>
43+
44+
<para>
45+
In order to set these parameters in your <filename>postgresql.conf</> file,
46+
you will need to add <literal>auth_delay</> to
47+
<xref linkend="guc-custom-variable-classes">. Typical usage might be:
48+
</para>
49+
50+
<programlisting>
51+
# postgresql.conf
52+
shared_preload_libraries = 'auth_delay'
53+
54+
custom_variable_classes = 'auth_delay'
55+
auth_delay.milliseconds = '500'
56+
</programlisting>
57+
</sect2>
58+
59+
<sect2>
60+
<title>Author</title>
61+
62+
<para>
63+
KaiGai Kohei <email>kaigai@ak.jp.nec.com</email>
64+
</para>
65+
</sect2>
66+
67+
</sect1>

‎doc/src/sgml/contrib.sgml

+1
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ psql -d dbname -f <replaceable>SHAREDIR</>/contrib/<replaceable>module</>.sql
8181
</para>
8282

8383
&adminpack;
84+
&auth-delay;
8485
&auto-explain;
8586
&btree-gin;
8687
&btree-gist;

‎doc/src/sgml/filelist.sgml

+1
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@
9393
<!-- contrib information -->
9494
<!entity contrib SYSTEM "contrib.sgml">
9595
<!entity adminpack SYSTEM "adminpack.sgml">
96+
<!entity auth-delay SYSTEM "auth-delay.sgml">
9697
<!entity auto-explain SYSTEM "auto-explain.sgml">
9798
<!entity btree-gin SYSTEM "btree-gin.sgml">
9899
<!entity btree-gist SYSTEM "btree-gist.sgml">

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy