login: logins by key capped per user

Review 6: a node remembers the challenges used until they expire, 10 000
at most, and refused every login by key once full. One user holding a
key could make 10 000 logins within five minutes and keep everyone else
out.

A user may now log in by key at most --key-logins-per-user times (100)
on a node within a challenge's lifetime, past which that user waits and
others don't; the 10 000 stay as the cap for all users together. The
lifetime, five minutes until now, is --challenge-lifetime.

1 files changed, 10 insertions, 0 deletions

diff --git a/docs/example.toml b/docs/example.toml
index d2d9a67..cce8780 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -95,6 +95,16 @@ htpasswd = "/etc/continuum/htpasswd"
 # logs in again.
 # session-lifetime = "7d"
 
+# How long a challenge to log in by key (POST /auth/challenge) is valid: the node
+# remembers each used until then, and counts a user's logins by key over it
+# (key-logins-per-user).
+# challenge-lifetime = "5m"
+
+# Logins by key a user may make on this node within a challenge's lifetime
+# (challenge-lifetime); past it, that user waits, others don't. 10 000 by all users
+# together at most.
+# key-logins-per-user = 100
+
 # Where the reverse proxies whose user-header is believed connect from: IP addresses (or
 # ranges, as ADDRESS/BITS), and unix for the API's Unix sockets (bind-addr). On a host
 # with other users, leave out the addresses and have the proxy use a Unix socket: others