Skip to content
  • Simon McVittie's avatar
    Revert "config: change default auth_timeout to 5 seconds" · 02e1ddf9
    Simon McVittie authored
    This reverts commit 54d26df5.
    
    It appears this change may cause intermittent slow or failed boot,
    more commonly on slower/older machines, in at least Mageia and
    possibly also Debian. This would indicate that while the system
    is under load, system services are not completing authentication
    within 5 seconds.
    
    This change was not the main part of fixing CVE-2014-3639, but does
    help to mitigate that attack. As such, increasing this timeout makes
    the denial of service attack described by CVE-2014-3639 somewhat
    more effective: a local user connecting to the system bus repeatedly
    from many parallel processes can cause other users' attempts to
    connect to take longer.
    
    If your machine boots reliably with the shorter timeout, and
    resilience against local denial of service attacks is important
    to you, putting this in /etc/dbus-1/system-local.conf
    or a file matching /etc/dbus-1/system.d/*.conf can restore
    the lower limit:
    
        <busconfig>
          <limit name="auth_timeout">5000</limit>
        </busconfig>
    
    Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431
    02e1ddf9