Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Why would an incorrect password attempt take a lot longer to process than a correct one?

When you get the correct login credentials, you are logged in immediately. When you get your password wrong, there's a second delay before you're notified and able to try again.

Is this a prevention against cracking, or is there something else going on behind the scenes?

share|improve this question

marked as duplicate by slhck, Gilles, Daniel Beck, Mokubai, haimg Jun 26 '12 at 18:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I've noticed a flaw on a couple of Linux systems which permitted me to login as 'bin' without requiring a password! – Frank R. Jun 24 '12 at 20:05
@Frank - what distro? I find this very surprising. – stefgosselin Jun 26 '12 at 18:20
distro=distributions.. yeah, for the longest time, there's been a security flaw which very few people know that allow a hacker to obtain the password for root! – Frank R. Jun 26 '12 at 20:10
up vote 43 down vote accepted

It is a prevention against cracking. It is a forced delay, usually about 2 or 3 seconds delay before a new login prompt is issued. This helps prevent automated attacks by making the iteration too long to be practical.

On linux, it can be configured in the /etc/login.defs file.

# Delay in seconds before being allowed another attempt after a login failure.
FAIL_DELAY              3
share|improve this answer
On my machine, that config file says that FAIL_DELAY is obsoleted by pam and should be handled in the /etc/pam.d/login file ( – matzahboy Jun 25 '12 at 1:03

The main reason is, like you said, to stop automated attacks. It just slows down a potential "bad guy" if he can only try ten passwords a minute instead of a hundred.

You'll also notice that the shell completely restarts after 3 or 4 failed attempts. I think this is to detach or kill any attached processes which could be malicious.

share|improve this answer

I guess it's a form of "Tarpitting" where the server delays incoming connections for as long as possible

share|improve this answer

Not the answer you're looking for? Browse other questions tagged .