On Thu, 11 Jul 2013, Daniel Black wrote:
>  > +            ^%(_apache_error_client)s invalid nonce .* received - user attempted time travel\s*$
>  > +            ^%(_apache_error_client)s user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
>  > +            ^%(_apache_error_client)s user .*: one-time-nonce mismatch - sending new nonce\s*$

>    nonces are a kind of salt provided by the server. They have a reasonable
>    length of time for normal use time in default settings so errors here are
>    probably malicious, or a person resuming a session they left of hours ago.

are there known attack vectors exercising some bugs in nonce code or
smth like that?  I am still not sure if banning on something occurring in
regular use is something we should by default do here.

>    As I put in the comments, the max retry cannot be set too low because an
>    initial fail is pretty much expected for the client to begin
>    authentication so even this login from a few hours ago scenario shouldn't
>    cause a ban.

well... what if many users come through the same proxy? ... once again
-- unless there is a very good reason, we should not ban on messages
associated with non-malicious use.

-- 
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate,     Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419
WWW:   http://www.linkedin.com/in/yarik