Account lock behavior for non existing user | Redfish Specification Forum

mharishm
Minnow

Posts: 17

Account lock behavior for non existing user Oct 31, 2022 15:51:29 GMT

Quote

Post by mharishm on Oct 31, 2022 15:51:29 GMT

Hi,

Based on "AccountLockoutThreshold" value the user gets locked for a specific period of time(till it reached the value specified in AccountLockoutDuration) on passing wrong password.

For example:

Lets say
"AccountLockoutCounterResetAfter": 30,
"AccountLockoutCounterResetEnabled": true,
"AccountLockoutDuration": 30,
"AccountLockoutThreshold": 5,

That means Redfish tries to protect the user accounts existent by imposing a 30 second account lockout whenever the password supplied is incorrect for a given user account 5 or more times.

i.e.,
For 4 login failue attempts, redfish will respond 401 - Unauthorised having message in error response like

"Message": "While attempting to establish a connection to /redfish/v1/AccountService, the service was denied access.",

On the 5th login failure attempt, redfish will respond 401 - Unauthorised having message in error response like

"Message": "Login for user Administrator was a failure because the number of unsuccessful login attempts has exceeded the set threshold. Administrator has been locked out for 30 seconds.",

Does the same behavior applicable even for non existing user.

Lets say user "xyz" is not a redfish account nor an external/remote account.

Does redfish should show account locked error message even on trying to access redfish API using non existent user after reaching the threshold limit? or is it ok to keep showing 401 -Unauthorised error meesage everytime without account locked error message(only for non existent account)?

"Locked" property from "ManagerAccount" schema specifies whether the account is locked or not. But for non existent user there will not be any information available in redfish server. So wondering how this situation can be handled if we are supposed to show account locked error message even when user tries to access redfish API using non existent user.

Please let us know your view on this?

Thanks,
Harish M

Last Edit: Oct 31, 2022 16:17:50 GMT by mharishm

mraineri
Administrator

Posts: 1,049

Account lock behavior for non existing user Oct 31, 2022 16:02:48 GMT

Quote

Post by mraineri on Oct 31, 2022 16:02:48 GMT

Normally you wouldn't give that level of detail in a response message when the client is not providing valid credentials; that sort of information can be used by an attacker to understand the state of the system. Security best practices, beyond Redfish, suggest returning as little information as possible in these cases, such as simply stating "Invalid username and/or password" with a 401 response.

Last Edit: Oct 31, 2022 16:05:20 GMT by mraineri

mharishm
Minnow

Posts: 17

Account lock behavior for non existing user Oct 31, 2022 16:30:29 GMT

Quote

Post by mharishm on Oct 31, 2022 16:30:29 GMT

So in that case showing error message for existing user and non existing user will be different and when trying to access a non-existent user, the firmware never locks out the account and keeps producing the same message there by opens an opportunity for an attacker to infer whether a user exists or not based on the account lockout behavior using “dictionary attack” approach.
Your view on this please.

Thanks,
Harish M

mraineri
Administrator

Posts: 1,049

Account lock behavior for non existing user Oct 31, 2022 17:07:59 GMT

Quote

Post by mraineri on Oct 31, 2022 17:07:59 GMT

What you send in a response versus what you do internally from a decision perspective are two entirely different things. You can certainly make them the same for your product, but Redfish does not specify this. But in the case of a non-existent user, there's nothing to lock out; the credentials are simply invalid.

However, just to be clear, showing different messages for valid users and non-existent users is a really bad practice in the security realm.

Last Edit: Oct 31, 2022 17:52:00 GMT by mraineri