search

digitalsurvival / ppp-pam

The Perfect Paper Passwords Pluggable Authentication Module
BSD 3-Clause "New" or "Revised" License
2 stars 0 forks source link

Suceptable to DOS attack. #14

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?

Since it asks you for a code regardless of whether your password is
correct, someone could keep sending login requests to the server, and as a
result, the counter would keep incrementing. What if I only had three cards
and the counter had reached the fourth? I'd be locked out of my system.

I know this doesn't affect people who have local access to their system
(they can just generate new cards after logging in locally), but it does
affect people that have dedicated servers without any physical access to.

What version of the product are you using? On what operating system?

0.2 on Ubuntu Gutsy & CentOS 4

Original issue reported on code.google.com by ana...@gmail.com on 13 Nov 2007 at 7:39

GoogleCodeExporter commented 9 years ago 
you could posibly write a php script or something that ( if it is a webserver ) 
to
email you a new card or something? i think that is a problem with ssh not 
necicarily
the ppp-pam module.

Original comment by pythonho...@gmail.com on 24 Nov 2007 at 4:38

GoogleCodeExporter commented 9 years ago 
I have found a simple solution for this problem.  Since the pam_unix.so module 
in
/etc/pam.d/common-auth is called before the PPP-PAM module (if you follow the 
default
instructions for installing this), I changed pam_unix.so from being "required" 
to
"requisite".  A failure at a requisite module will stop PAM from invoking the 
rest of
the modules, so PAM will not invoke the PPP module if pam_unix.so failed.  This
forces me to correctly enter my Linux password before the I am prompted for my 
PPP
passcode.  Now an attacker would have to know my Linux password before he could 
start
pushing the passcode counter off my current cards.

I have not experienced any other problems with the rest of my Linux server by 
doing
this, but I am only running ssh, samba, and squid on this server.  If this 
causes
problems with other systems, you can always replace the "@include common-auth" 
line
with the modules from the common-auth file with pam_unix.so changed to 
requisite.

Original comment by brianpgordon@gmail.com on 22 Feb 2008 at 5:01

GoogleCodeExporter commented 9 years ago 
The system could also lock out for a period of time after 2 PPP failures. When 
the
system is on the last 10 passcodes of the last card generated, it could either 
email
the user or tell them on login to generate more cards.

Original comment by kurtisnelson on 15 Aug 2008 at 1:09

GoogleCodeExporter commented 9 years ago

Original comment by Luke.Faraone on 9 Jan 2009 at 3:58