Re: Why does sudo return success for bad password?
Jeffrey Walton <[email protected]> Sat, 21 Mar 2020 03:07:09 -0400
| Newsgroups | gmane.comp.tools.sudo.user |
|---|---|
| Message-ID | <CAH8yC8kriEiircbYVAr-y=kAbQ15_cLh1BAh3K2k3r11a_PMhA@mail.gmail.com> |
On Sat, Mar 21, 2020 at 2:57 AM Grant Taylor via sudo-users <[email protected]> wrote: > > On 3/20/20 10:30 PM, Jeffrey Walton wrote: > > > Subject: Why does sudo return success for bad password? > > Returning one thing for a good password and something else for a bad > password can be used as an information leak. > > I expect that sudo purposefully returns the same thing for success and exit. Thanks Grant. Re: the information leak. Probably not. When a bad password is entered the attempt is throttled by the OS. The information leak is already present through timing. So there is no increase in risk for sudo. Jeff ____________________________________________________________ sudo-users mailing list <[email protected]> For list information, options, or to unsubscribe, visit: https://www.sudo.ws/mailman/listinfo/sudo-users