#2 Timed attacks.

[Johnny Mast]

Resendly there was a bug reported about proftpd. This
bug did allows hackers to bruteforce usernames by
messuring the time that a server needs to check
authorization from PAM modules. Extreme FTPD also uses
pam and it has the same behavure as proftpd because pam
sessions are a bit slower then when a shadow or
master.passwd file is being checked. The proftpd
developers got around it by developing there
"mod_delay" that delays shadow auth neganisms as long
as PAM auth (around 1.4 seconds or so). We face the
same treath so we need to defent our selfs as well.

(The advisory can be found here).
http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02