Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The most prominent place I've noticed this is when SSH-ing at work, but I feel like I've observed this behaviour elsewhere too.

When I try to log into Linux servers from my Windows desktop at work, I've noticed that if I mis-type my password, it takes a good 5 seconds or so before I get "Access Denied" back. Then when I type my password correctly, the login (along with welcome messages etc) is virtually instant.

Is there any logical reason for this, or would it be down to some odd configuration that's specific to the machines here at work?

share|improve this question
1  
There is a good discussion/answer of this on stackoverflow.com/questions/712339/…, including specifically reducing the Linux fail delay here and here –  drzaus Sep 18 '13 at 8:42

2 Answers 2

up vote 15 down vote accepted

There's probably an artificial timeout built-in to make it harder for a brute force attack to succeed.

You will see this on many login prompts that involve secure authentication...

share|improve this answer
    
Ah, hadn't thought of that. That makes perfect sense, and would explain why I feel like I've seen the same delay elsewhere. –  Cam Jackson Oct 28 '11 at 1:22

This is some intended delay to prevent brute force attacks. A longer delay also prevents the attacker being able to guess the difference between username is wrong and password is wrong (hashing and checking the password takes noticeable longer time than checking the username).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.