From 05943dad70ce17ff61b8c0352abeec0964ca14f0 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:39:06 +0000 Subject: login: logins by key capped per user Review 6: a node remembers the challenges used until they expire, 10 000 at most, and refused every login by key once full. One user holding a key could make 10 000 logins within five minutes and keep everyone else out. A user may now log in by key at most --key-logins-per-user times (100) on a node within a challenge's lifetime, past which that user waits and others don't; the 10 000 stay as the cap for all users together. The lifetime, five minutes until now, is --challenge-lifetime. --- docs/example.toml | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'docs/example.toml') diff --git a/docs/example.toml b/docs/example.toml index d2d9a67..cce8780 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -95,6 +95,16 @@ htpasswd = "/etc/continuum/htpasswd" # logs in again. # session-lifetime = "7d" +# How long a challenge to log in by key (POST /auth/challenge) is valid: the node +# remembers each used until then, and counts a user's logins by key over it +# (key-logins-per-user). +# challenge-lifetime = "5m" + +# Logins by key a user may make on this node within a challenge's lifetime +# (challenge-lifetime); past it, that user waits, others don't. 10 000 by all users +# together at most. +# key-logins-per-user = 100 + # Where the reverse proxies whose user-header is believed connect from: IP addresses (or # ranges, as ADDRESS/BITS), and unix for the API's Unix sockets (bind-addr). On a host # with other users, leave out the addresses and have the proxy use a Unix socket: others -- cgit v1.3.1