NAS-133911 / 25.04-RC.1 / Increase auth failure delay to minimum of 4 seconds (by anodos325)

src/middlewared/middlewared/etc_files/pam.d/common-auth.mako

@@ -23,6 +23,9 @@
             raise TypeError(f'{dstype}: unknown DSType')
 %>\
 
+%if render_ctx['system.security.config']['enable_gpos_stig']:
+auth	optional	pam_faildelay.so	delay=4000000
+%endif
 % if conf.primary:
 ${'\n'.join(line.as_conf() for line in conf.primary)}
 % endif

src/middlewared/middlewared/plugins/auth.py

@@ -739,7 +739,7 @@ async def login_ex(self, app, data):
                     if resp['pam_response'] == 'SUCCESS':
                         # Insert a failure delay so that we don't leak information about
                         # the PAM response
-                        await asyncio.sleep(random.uniform(1, 2))
+                        await asyncio.sleep(CURRENT_AAL.get_delay_interval())
                         await self.middleware.log_audit_message(app, 'AUTHENTICATION', {
                             'credentials': {
                                 'credentials': cred_type,
@@ -749,6 +749,7 @@ async def login_ex(self, app, data):
                         }, False)
 
                     else:
+                        await asyncio.sleep(CURRENT_AAL.get_delay_interval())
                         await self.middleware.log_audit_message(app, 'AUTHENTICATION', {
                             'credentials': {
                                 'credentials': cred_type,
@@ -900,7 +901,8 @@ async def login_ex(self, app, data):
                     await login_fn(app, cred)
                 else:
                     # Add a sleep like pam_delay() would add for pam_oath
-                    await asyncio.sleep(random.uniform(1, 2))
+                    await asyncio.sleep(CURRENT_AAL.get_delay_interval())
+
                     await self.middleware.log_audit_message(app, 'AUTHENTICATION', {
                         'credentials': {
                             'credentials': 'LOGIN_TWOFACTOR',
@@ -931,7 +933,7 @@ async def login_ex(self, app, data):
                 token_str = data['token']
                 token = self.token_manager.get(token_str, app.origin)
                 if token is None:
-                    await asyncio.sleep(random.uniform(1, 2))
+                    await asyncio.sleep(CURRENT_AAL.get_delay_interval())
                     await self.middleware.log_audit_message(app, 'AUTHENTICATION', {
                         'credentials': {
                             'credentials': 'TOKEN',
@@ -944,7 +946,7 @@ async def login_ex(self, app, data):
                     return response
 
                 if token.attributes:
-                    await asyncio.sleep(random.uniform(1, 2))
+                    await asyncio.sleep(CURRENT_AAL.get_delay_interval())
                     await self.middleware.log_audit_message(app, 'AUTHENTICATION', {
                         'credentials': {
                             'credentials': 'TOKEN',

src/middlewared/middlewared/utils/auth.py

@@ -1,6 +1,7 @@
 import enum
 import threading
 from dataclasses import dataclass
+from random import uniform
 from time import monotonic
 from .crypto import generate_string, sha512_crypt, check_unixhash
 
@@ -36,12 +37,19 @@ class AuthenticatorAssuranceLevel:
     max_inactivity: int | None
     mechanisms: tuple[AuthMech] | None
     otp_mandatory: bool
+    min_fail_delay: int
 
 
 @dataclass(slots=True)
 class ServerAAL:
     level: AuthenticatorAssuranceLevel
 
+    def get_delay_interval(self):
+        return uniform(
+            self.min_fail_delay,
+            self.min_fail_delay + 1
+        )
+
 
 def aal_auth_mechanism_check(mechanism_str: str, aal: AuthenticatorAssuranceLevel) -> bool:
     """ This method checks whether the specified mechanism is permitted under the
@@ -68,7 +76,8 @@ def aal_auth_mechanism_check(mechanism_str: str, aal: AuthenticatorAssuranceLeve
         AuthMech.TOKEN_PLAIN,
         AuthMech.PASSWORD_PLAIN,
     ),
-    otp_mandatory=False
+    otp_mandatory=False,
+    min_fail_delay=1
 )
 
 # NIST SP 800-63B Section 4.2 Authenticator Assurance Level 2
@@ -86,7 +95,8 @@ def aal_auth_mechanism_check(mechanism_str: str, aal: AuthenticatorAssuranceLeve
     max_session_age=12 * 60 * 60,
     max_inactivity=30 * 60,
     mechanisms=(AuthMech.PASSWORD_PLAIN,),
-    otp_mandatory=True
+    otp_mandatory=True,
+    min_fail_delay=4
 )
 
 # NIST SP 800-63B Section 4.3 Authenticator Assurance Level 3
@@ -96,7 +106,8 @@ def aal_auth_mechanism_check(mechanism_str: str, aal: AuthenticatorAssuranceLeve
     max_session_age=13 * 60,
     max_inactivity=15 * 60,
     mechanisms=(),
-    otp_mandatory=True
+    otp_mandatory=True,
+    min_fail_delay=4
 )
 
 CURRENT_AAL = ServerAAL(AA_LEVEL1)