From owner-freebsd-security  Thu Mar 18  9: 1: 7 1999
Delivered-To: freebsd-security@freebsd.org
Received: from axl.noc.iafrica.com (axl.noc.iafrica.com [196.31.1.175])
	by hub.freebsd.org (Postfix) with ESMTP id 58B5714BEC
	for <freebsd-security@freebsd.org>; Thu, 18 Mar 1999 09:01:00 -0800 (PST)
	(envelope-from sheldonh@axl.noc.iafrica.com)
Received: from sheldonh (helo=axl.noc.iafrica.com)
	by axl.noc.iafrica.com with local-esmtp (Exim 2.12 #1)
	id 10Ng8k-000M49-00; Thu, 18 Mar 1999 18:59:26 +0200
From: Sheldon Hearn <sheldonh@iafrica.com>
To: Zahemszky Gabor <zgabor@CoDe.hu>
Cc: freebsd-security@freebsd.org
Subject: Re: bug (?) in login limits from login.conf 
In-reply-to: Your message of "Thu, 18 Mar 1999 17:23:42 +0100."
             <199903181623.RAA00488@CoDe.hu> 
Date: Thu, 18 Mar 1999 18:59:26 +0200
Message-ID: <84824.921776366@axl.noc.iafrica.com>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org



On Thu, 18 Mar 1999 17:23:42 +0100, Zahemszky Gabor wrote:

> If there are any login restrictions (time/host or line) in /etc/login.conf,
> login responds with:
> <time restriction>:
> ``Logins not available right now''

While your comments are fair enough from a security-minded point of
view, you need to consider the confusion and frustration that your users
will experience when they type their username/password correctly and get
exactly the same message they'd get if they were typing their password
incorrectly.

Login(1) isn't the only part of the system that makes a trade-off
between security and sanity. See nologin(8) for one example.

Ciao,
Sheldon.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message