Chris LuandDevin ea859a0844 sftp: reject empty passwords in PasswordAuthenticator (#11938) ...

* sftp: reject empty passwords in PasswordAuthenticator

FileStore.ValidatePassword already refuses a zero-length stored or
supplied password, but the guard belongs at the authenticator too: an
empty password is never valid, and checking before the store call keeps
any user.Store implementation without its own empty-secret check from
matching on zero-length input.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* sftp: keep the brute-force delay on empty-password failures

The early rejection returned before the shared failure path, so an empty
password failed instantly while other failures slept 100-199 ms. Folding
the length check into the store call keeps the store untouched and every
failed attempt equally slow.

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-10-21 20:03:14 -07:00

..

auth_test.go

sftpd: support SSH user certificates signed by a trusted CA (#9815)

2026-06-03 22:32:47 -07:00

auth.go

sftpd: support SSH user certificates signed by a trusted CA (#9815)

2026-06-03 22:32:47 -07:00

certificate_test.go

sftpd: support SSH user certificates signed by a trusted CA (#9815)

2026-06-03 22:32:47 -07:00

certificate.go

sftpd: support SSH user certificates signed by a trusted CA (#9815)

2026-06-03 22:32:47 -07:00

password_test.go

sftp: reject empty passwords in PasswordAuthenticator (#11938)

2026-10-21 20:03:14 -07:00

password.go

sftp: reject empty passwords in PasswordAuthenticator (#11938)

2026-10-21 20:03:14 -07:00

publickey.go

Fix sftp performances and add seaweedfs all-in-one deployment (#6792)

2025-05-26 00:50:48 -07:00