Auth: 1/2/4 s after failed logins, AuthMinLength 10, no decoy hashing

FEDORA.md

@@ -190,9 +190,10 @@ rights in the user file:
 ```
 
 Each line of `/etc/newscache.users` is `user:hash:list:read:postto:allow`,
-for example `alice:$6$...:*:*:*:read,post`; `openssl passwd -6` makes the
-hash. Only `user:hash` is required: fields missing at the end add nothing,
-like empty ones. The file is read at login, after NewsCache has switched to its
+for example `alice-reader:$6$...:*:*:*:read,post`; `openssl passwd -6`
+makes the hash. Only `user:hash` is required: fields missing at the end add
+nothing, like empty ones. User names and passwords must have at least 10
+bytes: shorter ones are refused (`AuthMinLength`, default 10). The file is read at login, after NewsCache has switched to its
 `Username` (news), so that user must be able to read it. Until a client has
 logged in, it can only use `AUTHINFO`, `CAPABILITIES`, `MODE READER`, `HELP`
 and `QUIT`.

changes/fix-auth-failure-backoff.md

@@ -0,0 +1,31 @@
+Upgrading:
+* Logins with a user name or password shorter than 10 bytes are refused
+  (481) after the upgrade: the new option AuthMinLength defaults to 10.
+  Give such users longer names and passwords, or set "AuthMinLength 0"
+  to keep them. The sample auth file and the examples in the
+  documentation now use names and passwords of at least 10 bytes.
+
+Behaviour changes:
+* A failed login (AUTHINFO PASS) is answered with 481 after 1 second the
+  first time in a connection, after 2 seconds the second time and after
+  4 seconds the third time; then the connection is closed, as before. A
+  successful login is answered at once. The count is per connection, so
+  a client that connects again starts at 1 second. AuthFailureDelay
+  keeps its name: 0 turns the wait off, any other value (1 to 3600, as
+  in older configuration files) turns it on; the default is 1, on. Up to
+  1.3.22 the wait was AuthFailureDelay times the number of failures (15,
+  30 and 45 s by default).
+* A login with an unknown user, a locked or empty password field, or a
+  plain-text password field (--enable-plainpass) no longer does a dummy
+  password hash to take as long as a wrong password, so bots guessing
+  logins cost no CPU time for it. The time of a 481 may now tell whether
+  a user name exists.
+
+New options:
+* AuthMinLength bytes (default 10, 0 to 255, 0 turns it off): a user name
+  or password shorter than this is refused with 481 when AUTHINFO PASS
+  arrives, after the wait of AuthFailureDelay and without a password
+  check, a lookup or a PAM call. It counts as a failed login. AUTHINFO
+  USER still answers 381. The log says "failed authinfo for user ...
+  (user name shorter than AuthMinLength)" or "(password shorter than
+  AuthMinLength)", without the password. newscache -p prints it.

debian/README.Debian

@@ -63,7 +63,8 @@ and put one line per user into /etc/newscache.users:
 
   user:password-hash:*:*:*:read,post
 
-The fields after the hash are the groups the user may list, read and post
+User names and passwords must have at least 10 bytes: shorter ones
+are refused (AuthMinLength, default 10). The fields after the hash are the groups the user may list, read and post
 to, and the extra permissions (see newscache.conf(5)); only user and hash
 are required, and fields missing at the end add nothing. Create the hash with "openssl passwd -6" (or -1), and make
 the file readable for the group news only:

doc/NewsCache.texi

@@ -402,19 +402,39 @@ ClientTimeout 900
 @end example
 
 @cdindex AuthFailureDelay
-After a failed login (@code{AUTHINFO PASS} with a wrong user name or
-password), NewsCache waits @code{AuthFailureDelay} seconds before it
-answers 481; after the third failure in a connection it closes the
-connection. The default is 1 second; 0 answers at once. Values up to 3600
-are accepted for older configuration files, but the delay is at most 1
-second: a longer one only keeps a process busy per connection. (Up to
-1.3.22 the delay was multiplied by the number of failed logins: 15, 30
-and 45 seconds by default.)
+With @code{AuthFailureDelay} set to any value from 1 to 3600 (the
+default is 1), a failed login (@code{AUTHINFO PASS} with a wrong user
+name or password) is answered with 481 after 1 second the first time in
+a connection, after 2 seconds the second time and after 4 seconds the
+third time; then NewsCache closes the connection. A successful login is
+answered at once. The count is per connection: a client that connects
+again starts at 1 second. 0 turns the wait off: every 481 comes at once,
+and the connection is still closed after the third failure. Values above
+1 are accepted for older configuration files and work like 1. (Up to
+1.3.22 the delay was the value times the number of failed logins: 15, 30
+and 45 seconds by default.) NewsCache does no dummy password check for
+an unknown user or a locked password field, so the time of a 481 may
+tell whether a user name exists.
 
 @example
 AuthFailureDelay 0
 @end example
 
+@cdindex AuthMinLength
+@code{AuthMinLength} is the shortest user name and password a login may
+have, counted in bytes. When @code{AUTHINFO PASS} arrives, a user name
+or password shorter than this is refused with 481 after the wait of
+@code{AuthFailureDelay}, without a password check, a lookup or a PAM
+call; it counts as a failed login. @code{AUTHINFO USER} is answered with
+381 as before. The default is 10, the range 0 to 255; 0 turns the check
+off. Administrators must use user names and passwords of at least 10
+bytes; set @code{AuthMinLength 0} only to keep shorter ones that
+already exist.
+
+@example
+AuthMinLength 10
+@end example
+
 @cdindex MaxArticleSize
 @cdindex MaxPostSize
 NewsCache holds an article in memory as a whole. @code{MaxArticleSize}
@@ -1144,7 +1164,8 @@ rights of its entry from the start. An entry with only @code{allow
 authentication} and one of these logins still lets nobody read or post
 without a login, as in the example below, but because it gives no
 rights: the commands that need one get @samp{480} until the login. As RFC 4643 says, a failed login (wrong password, unknown user,
-a stored hash that can't be checked) gets 481, @code{AUTHINFO PASS}
+a stored hash that can't be checked, a user name or password shorter
+than @code{AuthMinLength}) gets 481, @code{AUTHINFO PASS}
 without @code{AUTHINFO USER} gets 482, and @code{AUTHINFO} after a
 successful login, or where the entry has @code{Authentication none},
 gets 502. Before the login, commands that need a right the client doesn't

docker/newscache.conf

@@ -29,7 +29,8 @@ AccessList {
   # Or, instead of the Default entry below, let in anyone who logs in. The
   # entry allows only the login; the rights come from the user file, one
   # user:hash:list:read:postto:allow line per user, e.g.
-  # alice:$6$...:*:*:*:read,post (hash from "openssl passwd -6"; mount that
+  # alice-reader:$6$...:*:*:*:read,post (hash from "openssl passwd -6"; user
+  # names and passwords need at least 10 bytes, AuthMinLength; mount that
   # file too, readable by the news user). "allow read post" here would make
   # the login optional: clients that don't log in could read and post.
   #Default {

etc/newscache.auth-dist

@@ -1,12 +1,14 @@
 # This are commentar lines
 # You can use plaintext passwords, if the newscache is configured with
 # the option --enable-plainpass
-user1:pass1:at.linux:at.linux:at.linux:post
-user2:pass2:de.linux:de.linux:de.linux:post
-user3:xtKlYxMWGiBYg:de.linux:de.linux:de.linux:post
+# User names and passwords need at least 10 bytes (AuthMinLength
+# in newscache.conf); shorter ones are refused.
+reader-one:password-one:at.linux:at.linux:at.linux:post
+reader-two:password-two:de.linux:de.linux:de.linux:post
+reader-three:xtKlYxMWGiBYg:de.linux:de.linux:de.linux:post
 # Only user and password are required; missing fields add nothing, so
-# user4 gets just the rights of its Client entry after logging in.
-user4:pass4
+# reader-four gets just the rights of its Client entry after logging in.
+reader-four:password-four
 # The default build recognizes raw MD5 as base64(MD5(password)); this is
 # unsalted and weak. Prefer a salted crypt(3) hash supported by this system.
 # htpasswd defaults to APR1 ($apr1$), which NewsCache does not support;

etc/newscache.conf-dist

@@ -146,7 +146,9 @@ Admin root@localhost
 #       with newscache -t the client is matched by its address.
 #       Login example: anyone may connect, but must log in first. The
 #       entry allows only the login itself; the rights come from the user
-#       file (user:hash:list:read:postto:allow, e.g. alice:$6$...:*:*:*:read,post).
+#       file (user:hash:list:read:postto:allow, e.g.
+#       alice-reader:$6$...:*:*:*:read,post; user names and passwords need
+#       at least 10 bytes, see AuthMinLength).
 #       With "allow read post" instead, the login would be optional and
 #       clients that don't log in could read and post too.
 #         Default {
@@ -366,10 +368,17 @@ NewsServerList {
 # stop reading their replies, or stop sending in the middle of a POST)
 ClientTimeout 600
 
-# After a failed login, wait this many seconds before answering 481
-# (0 or 1; default 1). The connection is closed after the third failure.
+# Wait 1, 2 and 4 s before answering the first, second and third failed
+# login in a connection with 481; then the connection is closed. A
+# successful login doesn't wait. 0 turns the wait off (default 1; values
+# up to 3600 from older configurations work like 1).
 # AuthFailureDelay 1
 
+# Refuse user names and passwords shorter than this many bytes (481, a
+# failed login, no password check). Use at least 10 bytes for both;
+# 0 turns the check off (default 10, range 0 to 255).
+# AuthMinLength 10
+
 # Serve ARTICLE <message-id> and the like from the spool when it has the
 # article, using a history in SpoolDirectory/.history (default off)
 # History on

man/newscache.conf.5.in

@@ -147,7 +147,10 @@ The default values are 3600 seconds for both parameter.
 Terminate the connection after t seconds inactivity. The default value is 1200 seconds. The same limit applies to each write to the client and, plus 10 seconds, to each read inside a command (the article of a POST). The whole article of a POST must arrive within t seconds after the 340 reply, however steadily it is sent: a client that stops reading its replies, or sends an article too slowly, is disconnected too, with 400 for the article.
 .TP
 .I "AuthFailureDelay seconds"
-After a failed login (AUTHINFO PASS), wait this many seconds before answering 481; after the third failure the connection is closed. The default is 1 second; 0 answers at once. Values up to 3600 are accepted for older configuration files, but the delay is at most 1 second: a longer one only keeps a process busy per connection. (Up to 1.3.22 the delay was multiplied by the number of failed logins: 15, 30 and 45 seconds by default.)
+With any value from 1 to 3600 (the default is 1), a failed login (AUTHINFO PASS) is answered with 481 after 1 second the first time in a connection, after 2 seconds the second time and after 4 seconds the third time; then the connection is closed. A successful login is answered at once. The count is per connection: a client that connects again starts at 1 second. 0 turns the wait off: every 481 comes at once, and the connection is still closed after the third failure. Values above 1 are accepted for older configuration files and work like 1. (Up to 1.3.22 the delay was the value times the number of failed logins: 15, 30 and 45 seconds by default.) NewsCache does no dummy password check for an unknown user or a locked password field, so the time of a 481 may tell whether a user name exists.
+.TP
+.I "AuthMinLength bytes"
+The shortest user name and password a login may have, counted in bytes. When AUTHINFO PASS arrives, a user name or password shorter than this is refused with 481 after the wait of AuthFailureDelay, without a password check, a lookup or a PAM call; it counts as a failed login. AUTHINFO USER is answered with 381 as before. The default is 10, the range 0 to 255; 0 turns the check off. Administrators must use user names and passwords of at least 10 bytes; set AuthMinLength 0 only to keep shorter ones that already exist.
 .TP
 .I "History on|off"
 With on (or yes), keep a history of the articles in the spool (the directory .history in SpoolDirectory) and serve ARTICLE, HEAD, BODY, STAT and the message-ID forms of XHDR, XPAT and HDR from the spool when it has the article; see the manual, "Articles by Message-ID". The history counts toward SpoolSize; newscacheclean removes it when it alone takes more than half of SpoolSize, and when History is off. The default is off: every message-ID request goes to the news server.
@@ -391,15 +394,15 @@ Only
 .B unix
 without fields makes the login required: until then every command but CAPABILITIES, MODE READER, AUTHINFO, HELP and QUIT gets 480, whatever the entry allows.
 With file:, pam (also without fields), pam+file and unix with fields the login is optional: the client has the rights of its entry from the start, and a login adds those of the user. An entry that allows only authentication still lets nobody in without a login, but for another reason: it gives no rights, so the commands that need one get 480 until the login (those that need none, such as DATE, work).
-A failed login (wrong password, unknown user, a stored hash that can't be checked) is answered with 481, AUTHINFO PASS without AUTHINFO USER with 482, and AUTHINFO after a successful login, or where the entry has Authentication none, with 502 (RFC 4643). Possible values are:
+A failed login (wrong password, unknown user, a stored hash that can't be checked, a user name or password shorter than AuthMinLength) is answered with 481, AUTHINFO PASS without AUTHINFO USER with 482, and AUTHINFO after a successful login, or where the entry has Authentication none, with 502 (RFC 4643). Possible values are:
 .IP none
 no further authentication necessary
 .IP file:/path/to/file
 formatdescription:
 .nf
 		username:password:list:read:postto:allow
 .fi
-Only username and password are required. Fields missing at the end add nothing, like empty ones: a line \fBalice:hash\fR only checks the login, and the client keeps the rights of its Client entry. A password field that is empty or starts with * or ! locks the user: no password matches it.
+Only username and password are required. Fields missing at the end add nothing, like empty ones: a line \fBalice-reader:hash\fR only checks the login, and the client keeps the rights of its Client entry. A password field that is empty or starts with * or ! locks the user: no password matches it.
 The additional access specifications are added to the normal List, Read and PostTo parameters (see above and the examples).
 In the default build, NewsCache recognizes a raw-MD5 password value as base64-encoded MD5, 24 characters ending in \fB==\fR. This legacy format is unsalted and weak; do not use it for new passwords. Otherwise, NewsCache passes the stored value to the system's \fBcrypt(3)\fR; the supported algorithms vary by platform. Apache \fBhtpasswd\fR defaults to APR1 hashes (\fB$apr1$\fR), which are not supported by the system \fBcrypt(3)\fR implementations used with NewsCache. SHA-512 crypt hashes (\fB$6$\fR) work only where the system's \fBcrypt(3)\fR supports them; generate one with \fBopenssl passwd -6\fR or \fBmkpasswd -m sha-512\fR where available. With \fB--without-md5auto\fR, all stored values are checked as MD5, so \fBcrypt(3)\fR hashes cannot be used. Plaintext passwords are accepted only if NewsCache was built with \fB--enable-plainpass\fR. In the allow field, additional permissions can be specified (for example, allowing an authenticated user to post).
 .IP unix:list:read:postto:allow