[tpop3d-discuss] Patch to prevent brute force password cracking

[Yann GROSSEL]

Hi,

I'm looking for a new pop server to replace our aging qpopper,
and I found that tpop3d seems to be really nice. However there
are a few things I'd like to see in the pop daemon we'll use
that tpop3d lacks for the moment :

- delayed error responses (at least during authentification), to
prevent an attacker from doing brute force password cracking. That
is, once an user has attempted a wrong APOP or USER/PASS command,
the ERR answer doesn't come immediately, but only after a few seconds.
I've done a quick (attached) patch that do the thing. I'd like to
know what do you think about such a feature, and about my implementation ?

- multiple mysql servers (we'll be using a mysql cluster). I've
seen that this feature has been added to the TODO file in CVS and
I'm willing to implement it. I've already done a small patch that
seem to work but it still has a few problems. I'll keep working on
it.

Thanks in advance for your feedback :)

Yann GROSSEL

tpop3d-CVS-delayed-responses.patch
Description: Binary data