auth_delay
The auth_delay directive introduces a configurable delay in authentication responses.
Description
The auth_delay directive is designed to introduce a specific amount of delay in processing authentication requests. By adding delays, it helps mitigate brute-force attacks and improve security by making it more difficult for attackers to guess credentials within a short timeframe. The directive can accept time values in various formats (like seconds or minutes), allowing for flexibility in its configuration. For example, you can configure it to impose a 5-second delay after every failed authentication attempt.
When implementing auth_delay, it can be specified in different contexts, including http, server, and location. This means that you can apply the delay globally or at more granular levels, allowing for tailored security measures based on particular parts of your application. While the introduction of an authentication delay can improve security, it can also impact user experience if set excessively high; thus, it's essential to strike the right balance when configuring this directive.
Additionally, when using the auth_delay, administrators should be cautious about the potential increase in response time during legitimate requests, making it critical to monitor and adjust accordingly based on observed traffic patterns and threat levels. It's generally advisable to start with minimal delays and gradually increase them based on the sensitivity of the resources being protected and the types of threats encountered.
Config Example
http {
auth_delay 5s;
}
server {
location /login {
auth_delay 3s;
}
}Setting the delay too high can frustrate legitimate users.
This directive only applies to authentication requests; it won't affect non-authentication actions.