RANGER-5690: Distinct-IP fan-out delay for UnixAuth (replace account hard lockout)#1102
Draft
ramackri wants to merge 2 commits into
Draft
RANGER-5690: Distinct-IP fan-out delay for UnixAuth (replace account hard lockout)#1102ramackri wants to merge 2 commits into
ramackri wants to merge 2 commits into
Conversation
…guessing Track failed login attempts per username in addition to per-source-IP throttling. Account lockout uses separate configurable threshold, window, and lockout duration. Defaults match IP policy; account lockout can be disabled via config.
ramackri
requested review from
dhavaljrajpara,
dhavalshah9131,
fimugdha and
vperiasamy
July 22, 2026 13:53
Replace hard account lockout with opt-in throttling that tracks distinct failing source IPs per username, applies exponential backoff before the OS validator, and exempts admin.users. IP hard lockout is unchanged; account throttling defaults to disabled on upgrade.
ramackri
changed the title
ramackri
marked this pull request as draft
July 23, 2026 04:45
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hard account lockout on UnixAuth could be abused to block a real user with bogus attempts, with no self-service unlock. This PR replaces that with opt-in account throttling: track distinct failing source IPs per username, apply a short exponential delay before the OS validator, and never hard-reject on account. Per-IP lockout is unchanged.
How it works (when
account.lockout.enabled=true)We track which IPs failed against a username, not total failure count. Delay starts once distinct failing IPs reach the threshold (default 3). Delay doubles for each additional distinct IP, capped at 5s. The validator always runs after the wait.
Distributed attack against
alice(threshold=3, step=1s, max=5s):Same IP retrying
alicedoes not add a new distinct IP — no extra account delay (IP throttling still applies).Admin users (
admin.users) are exempt from account tracking. Successful login clears the distinct-IP set for that account.Defaults
account.lockout.enabled=false— upgrades unchanged; enable explicitly for fan-out throttlingdistinct.ip.threshold=3,delay.step.ms=1000,max.delay.ms=5000Test plan
unixauthserviceunit tests (33 pass)ranger-3.0.0-SNAPSHOT-usersync.tar.gzbuilds