From 05943dad70ce17ff61b8c0352abeec0964ca14f0 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:39:06 +0000 Subject: login: logins by key capped per user Review 6: a node remembers the challenges used until they expire, 10 000 at most, and refused every login by key once full. One user holding a key could make 10 000 logins within five minutes and keep everyone else out. A user may now log in by key at most --key-logins-per-user times (100) on a node within a challenge's lifetime, past which that user waits and others don't; the 10 000 stay as the cap for all users together. The lifetime, five minutes until now, is --challenge-lifetime. --- docs/access.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 909d915..3541efd 100644 --- a/docs/access.md +++ b/docs/access.md @@ -125,9 +125,11 @@ jq -n --arg c "$c" --rawfile s sig '{user: "alice", challenge: $c, signature: $s curl -s -X POST localhost:3000/auth/login/key -H 'Content-Type: application/json' -d @- ``` -A challenge is the node's, signed by it, valid for five minutes, and taken once (the -node remembers which in memory: after a restart, one captured in its five minutes -could be taken once more; it goes over TLS, as passwords do); +A challenge is the node's, signed by it, valid for five minutes (`--challenge-lifetime`), +and taken once (the node remembers which in memory: after a restart, one captured in +its five minutes could be taken once more; it goes over TLS, as passwords do). A user +logs in by key at most 100 times on a node within those minutes +(`--key-logins-per-user`), so one holding a key can't keep the others out; the signature must be by one of the user's keys, as the registry the node holds then says, and the user enabled (`401` if not, saying why). A swarm without a registry has no keys (`409`). -- cgit v1.3.1