On Monday, October 22, 2012 02:46:07 PM Steve Grubb wrote:
On Monday, October 22, 2012 11:03:24 AM David Smith wrote:
Does anyone have definitive documentation on proper implementation of pam_faillock that will serve our purposes here?
For common criteria, it was put in /etc/pam.d/system-auth-ac, which can be overwritten. It was used like this:
auth [default=die] pam_faillock.so authfail unlock_time=604800 root_unlock_time=900
auth required pam_faillock.so authsucc unlock_time=604800 root_unlock_time=900
Oops...forgot the above line. Should be 2 pam_faillock lines, one for fail and one for success.
You could place it in the entry points, too: login, remote, sshd, gdm, kdm, xdm, vsftpd... but its probably easier to just put it in system-auth and make sure its never tampered with by running periodic scans.
You have to be careful that nothing before it is labelled as sufficient. When something is sufficient, then pam stops processing and returns its answer to the app. So, in our setup, we changed pam_unix from this:
auth sufficient pam_unix.so nullok try_first_pass
into this:
auth [success=1 default=bad] pam_unix.so nullok try_first_pass
pam.conf(5) explains the options inside the [ ].
-Steve _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide