Connection caching?

[Darren Tucker]

Carson Gaspar wrote:

> When I implemented this eternities ago, the purpose was to require 
> something that wasn't password based auth first, and then password auth. 
> That way, you can turn on bad password account lockout without it being 
> incredibly easy to cause a DOS.

OK, fair enough.  You could also prevent password guessing if you don't 
have lockout.

Is your patch still floating around someplace?

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.