Index: openssh-5.3p1/auth.h =================================================================== --- openssh-5.3p1.orig/auth.h 2008-11-05 05:20:46.000000000 +0000 +++ openssh-5.3p1/auth.h 2010-01-24 10:28:35.000000000 +0000 @@ -53,6 +53,7 @@ int valid; /* user exists and is allowed to login */ int attempt; int failures; + int server_caused_failure; int force_pwchange; char *user; /* username sent by the client */ char *service; Index: openssh-5.3p1/auth2-gss.c =================================================================== --- openssh-5.3p1.orig/auth2-gss.c 2007-12-02 11:59:45.000000000 +0000 +++ openssh-5.3p1/auth2-gss.c 2010-01-24 10:28:35.000000000 +0000 @@ -102,6 +102,7 @@ if (!present) { xfree(doid); + authctxt->server_caused_failure = 1; return (0); } @@ -109,6 +110,7 @@ if (ctxt != NULL) ssh_gssapi_delete_ctx(&ctxt); xfree(doid); + authctxt->server_caused_failure = 1; return (0); } Index: openssh-5.3p1/auth2.c =================================================================== --- openssh-5.3p1.orig/auth2.c 2009-06-22 07:11:07.000000000 +0100 +++ openssh-5.3p1/auth2.c 2010-01-24 10:28:35.000000000 +0000 @@ -274,6 +274,7 @@ #endif authctxt->postponed = 0; + authctxt->server_caused_failure = 0; /* try to authenticate user */ m = authmethod_lookup(method); @@ -346,7 +347,8 @@ } else { /* Allow initial try of "none" auth without failure penalty */ - if (authctxt->attempt > 1 || strcmp(method, "none") != 0) + if (!authctxt->server_caused_failure && + (authctxt->attempt > 1 || strcmp(method, "none") != 0)) authctxt->failures++; if (authctxt->failures >= options.max_authtries) { #ifdef SSH_AUDIT_EVENTS