Rename min-reauth-time option

min-reauth-time option is currently misleading. Its description states:

# The time (in seconds) that a client is not allowed to reconnect after
# a failed authentication attempt.
min-reauth-time = 300

min-reauth-time was introduced long before the score-based banning system existed. Originally, it simply defined a reconnection delay after a failed authentication attempt. It now serves a different purpose: it sets the duration an IP address is banned after reaching max-ban-score. This is only explained deeper in the documentation:

# Banning clients in ocserv works with a point system. IP addresses
# that get a score over that configured number are banned for
# min-reauth-time seconds.

Users are unlikely to discover this connection without thoroughly studying the documentation or reading the source code. That misleading name can cause administrators to misconfigure their systems. Users looking to configure ban duration will naturally search for options containing "ban-". The first they will encounter is ban-reset-time:

# The time (in seconds) that all score kept for a client is reset.
ban-reset-time = 1200

This can mistakenly lead a user to believe that setting ban-reset-time = 1200 results in a 20-minute ban, when in fact this setting only controls how frequently a client's penalty score is cleared.

Therefore, I suggest to rename min-reauth-time to ban-time, e.g.:

# The duration (in seconds) an IP address remains banned after exceeding max-ban-score
# Default: 600 (10 minutes)
ban-time = 600
Edited Dec 11, 2025 by Grigory Trenin
Assignee Loading
Time tracking Loading