Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say you type in passwd and you enter in the wrong password. There's a noticeable delay between when it tells you that the password was bad and when you enter it. Any ideas as to why? Seems kinda strange...

Here's the message I'm getting when I enter in a bad password is as follows:

passwd: Authentication token manipulation error
passwd: password unchanged

Maybe it's attempting to protect against brute force attempts by reducing the speed with which new passwords can be tried?

Either way is there some discussion of this behavior somewhere? I don't see any note of it in the man page..

share|improve this question
up vote 5 down vote accepted

Yes, the delay is a protection against brute force, and is around 3 seconds.

The reason why it doesn't appear in the passwd man, is because it is controlled by the authentication backend - usually pam.

man pam_unix

Shows you can set a nodelay to eliminate the delay. You can also set applications specific delays in pam_faildelay

man pam_faildelay

These settings are all managed in

share|improve this answer

Yes, this is to prevent brute force attacks.

An alphanumeric 6 character password can have up to 36 bits of entropy (6 bits per character). If a computer can check 1 billion passwords per second, it will need only 2 ^ 36 / 1 billion = 69 seconds to try all possible passwords. A delay of one second means that only one password can be tried per second. Trying all possible passwords would take 2179 years now...

The delay isn't handled by passwd itself, but by the Pluggable Authentication Modules.

The delay can be disabled for passwd by adding the option nodelay to the line

password        [success=2 default=ignore] obscure sha512

in /etc/pam.d/common-password. Since this would affect all other programs using that configuration file as well, you could copy it over /etc/pam.d/passwd and disable the delay only there.

See also: man pam_unix

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .