From shawn at redhat.com Thu Aug 20 11:32:39 2015 Content-Type: multipart/mixed; boundary="===============0501983196206512504==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] changed pam_tally2 to pam_faillock Date: Tue, 23 Oct 2012 16:01:55 -0400 Message-ID: <5086F7B3.8040104@redhat.com> In-Reply-To: 1350997168-24504-2-git-send-email-dsmith@eclipse.ncsc.mil --===============0501983196206512504== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/23/12 8:59 AM, David Smith wrote: > Signed-off-by: David Smith > --- > RHEL6/input/system/accounts/pam.xml | 13 ++++++------- > 1 files changed, 6 insertions(+), 7 deletions(-) > > diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/acc= ounts/pam.xml > index 21bb8d1..64b6045 100644 > --- a/RHEL6/input/system/accounts/pam.xml > +++ b/RHEL6/input/system/accounts/pam.xml > @@ -365,18 +365,17 @@ and a second to use unlock_time and set it to a Val= ue > Set Deny For Failed Password Attempts > > To configure the system to lock out accounts after a number of incorrec= t login > -attempts using pam_tally2.so: > +attempts using pam_faillock.so: >

> -Add the following line immediately below the pam_env.so stateme= nt in /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth: > -
auth required pam_tally2.so deny=3D3 onerr=3Dfail unlock_time=3D900=
> +Add the following lines immediately below the pam_env.so statem= ent in /etc/pam.d/system-auth-ac: > +
auth [default=3Ddie] pam_faillock.so authfail deny=3D3 unlock_time=
=3D900
> +
auth required pam_faillock.so authsucc deny=3D3 unlock_time=3D900

I see Jeff already ack'd this, but per vendor documentation at =

https://access.redhat.com/knowledge/solutions/62949 this should be =

changed to read:


Change /etc/pam.d/system-auth & /etc/pam.d/password-auth to read as follows:

|   auth        required      pam_env.so
  *  auth        required      pam_faillock.so preauth silent audit deny=3D=
3 even_deny_root unlock_time=3D900 root_unlock_time=3D**900*
   auth        sufficient    pam_unix.so nullok try_first_pass
   *auth        [default=3Ddie] pam_faillock.so authfail audit deny=3D3
   auth        sufficient pam_faillock.so authsucc audit deny=3D3*
   auth        requisite     pam_succeed_if.so uid >=3D 500 quiet
   auth        required      pam_deny.so

  *  account     required      pam_faillock.so*
   account     required      pam_unix.so
   account     sufficient    pam_localuser.so
   account     sufficient    pam_succeed_if.so uid < 500 quiet
   account     required      pam_permit.so

   password    requisite     pam_cracklib.so try_first_pass retry=3D3 type=
=3D
   password    sufficient    pam_unix.so sha512 shadow nullok try_first_pas=
s use_authtok
   password    required      pam_deny.so

   session     optional      pam_keyinit.so revoke
   session     required      pam_limits.so
   session     optional      pam_oddjob_mkhomedir.so debug
   session     [success=3D1 default=3Dignore] pam_succeed_if.so service in =
crond quiet use_uid
   session     required      pam_unix.so|






--===============0501983196206512504==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"

PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG
LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9
IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4
Ij5PbiAxMC8yMy8xMiA4OjU5IEFNLCBEYXZpZCBTbWl0aCB3cm90ZTo8YnI+CiAgICA8L2Rpdj4K
ICAgIDxibG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDoxMzUwOTk3MTY4LTI0NTA0LTItZ2l0LXNl
bmQtZW1haWwtZHNtaXRoQGVjbGlwc2UubmNzYy5taWwiCiAgICAgIHR5cGU9ImNpdGUiPgogICAg
ICA8cHJlIHdyYXA9IiI+ClNpZ25lZC1vZmYtYnk6IERhdmlkIFNtaXRoIDxhIGNsYXNzPSJtb3ot
dHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpkc21pdGhAZWNsaXBzZS5uY3NjLm1pbCI+
Jmx0O2RzbWl0aEBlY2xpcHNlLm5jc2MubWlsJmd0OzwvYT4KLS0tCiBSSEVMNi9pbnB1dC9zeXN0
ZW0vYWNjb3VudHMvcGFtLnhtbCB8ICAgMTMgKysrKysrLS0tLS0tLQogMSBmaWxlcyBjaGFuZ2Vk
LCA2IGluc2VydGlvbnMoKyksIDcgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvUkhFTDYvaW5w
dXQvc3lzdGVtL2FjY291bnRzL3BhbS54bWwgYi9SSEVMNi9pbnB1dC9zeXN0ZW0vYWNjb3VudHMv
cGFtLnhtbAppbmRleCAyMWJiOGQxLi42NGI2MDQ1IDEwMDY0NAotLS0gYS9SSEVMNi9pbnB1dC9z
eXN0ZW0vYWNjb3VudHMvcGFtLnhtbAorKysgYi9SSEVMNi9pbnB1dC9zeXN0ZW0vYWNjb3VudHMv
cGFtLnhtbApAQCAtMzY1LDE4ICszNjUsMTcgQEAgYW5kIGEgc2Vjb25kIHRvIHVzZSB1bmxvY2tf
dGltZSBhbmQgc2V0IGl0IHRvIGEgVmFsdWUKICZsdDt0aXRsZSZndDtTZXQgRGVueSBGb3IgRmFp
bGVkIFBhc3N3b3JkIEF0dGVtcHRzJmx0Oy90aXRsZSZndDsKICZsdDtkZXNjcmlwdGlvbiZndDsK
IFRvIGNvbmZpZ3VyZSB0aGUgc3lzdGVtIHRvIGxvY2sgb3V0IGFjY291bnRzIGFmdGVyIGEgbnVt
YmVyIG9mIGluY29ycmVjdCBsb2dpbgotYXR0ZW1wdHMgdXNpbmcgJmx0O3R0Jmd0O3BhbV90YWxs
eTIuc28mbHQ7L3R0Jmd0OzoKK2F0dGVtcHRzIHVzaW5nICZsdDt0dCZndDtwYW1fZmFpbGxvY2su
c28mbHQ7L3R0Jmd0OzoKICZsdDticiAvJmd0OyZsdDticiAvJmd0OwotQWRkIHRoZSBmb2xsb3dp
bmcgbGluZSBpbW1lZGlhdGVseSBiZWxvdyB0aGUgJmx0O3R0Jmd0O3BhbV9lbnYuc28mbHQ7L3R0
Jmd0OyBzdGF0ZW1lbnQgaW4gJmx0O3R0Jmd0Oy9ldGMvcGFtLmQvc3lzdGVtLWF1dGgtYWMmbHQ7
L3R0Jmd0OyBhbmQgJmx0O3R0Jmd0Oy9ldGMvcGFtLmQvcGFzc3dvcmQtYXV0aCZsdDsvdHQmZ3Q7
OgotJmx0O3ByZSZndDthdXRoIHJlcXVpcmVkIHBhbV90YWxseTIuc28gZGVueT0zIG9uZXJyPWZh
aWwgdW5sb2NrX3RpbWU9OTAwJmx0Oy9wcmUmZ3Q7CitBZGQgdGhlIGZvbGxvd2luZyBsaW5lcyBp
bW1lZGlhdGVseSBiZWxvdyB0aGUgJmx0O3R0Jmd0O3BhbV9lbnYuc28mbHQ7L3R0Jmd0OyBzdGF0
ZW1lbnQgaW4gJmx0O3R0Jmd0Oy9ldGMvcGFtLmQvc3lzdGVtLWF1dGgtYWMmbHQ7L3R0Jmd0OzoK
KyZsdDtwcmUmZ3Q7YXV0aCBbZGVmYXVsdD1kaWVdIHBhbV9mYWlsbG9jay5zbyBhdXRoZmFpbCBk
ZW55PTMgdW5sb2NrX3RpbWU9OTAwJmx0Oy9wcmUmZ3Q7CismbHQ7cHJlJmd0O2F1dGggcmVxdWly
ZWQgcGFtX2ZhaWxsb2NrLnNvIGF1dGhzdWNjIGRlbnk9MyB1bmxvY2tfdGltZT05MDAmbHQ7L3By
ZSZndDs8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIEkgc2VlIEplZmYgYWxy
ZWFkeSBhY2snZCB0aGlzLCBidXQgcGVyIHZlbmRvciBkb2N1bWVudGF0aW9uIGF0CiAgICA8YSBj
bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL2FjY2Vzcy5yZWRoYXQu
Y29tL2tub3dsZWRnZS9zb2x1dGlvbnMvNjI5NDkiPmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20v
a25vd2xlZGdlL3NvbHV0aW9ucy82Mjk0OTwvYT4gdGhpcyBzaG91bGQgYmUKICAgIGNoYW5nZWQg
dG8gcmVhZDo8YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgICBDaGFuZ2UgL2V0Yy9wYW0uZC9zeXN0
ZW0tYXV0aCAmYW1wOyAvZXRjL3BhbS5kL3Bhc3N3b3JkLWF1dGggdG8gcmVhZAogICAgYXMgZm9s
bG93czo8YnI+CiAgICA8bWV0YSBjaGFyc2V0PSJ1dGYtOCI+CiAgICA8cHJlIHN0eWxlPSJiYWNr
Z3JvdW5kLWNvbG9yOiB3aGl0ZTsgZm9udC1zaXplOiAxM3B4OyBib3JkZXItd2lkdGg6IDFweCAx
cHggMXB4IDJweDsgYm9yZGVyLXN0eWxlOiBzb2xpZDsgYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAy
MzgsIDIzOCkgcmdiKDIzOCwgMjM4LCAyMzgpIHJnYigyMzgsIDIzOCwgMjM4KSByZ2IoMjA0LCAy
MDQsIDIwNCk7IG1hcmdpbjogMTBweCAyMHB4OyBwYWRkaW5nOiAxMHB4OyB2ZXJ0aWNhbC1hbGln
bjogYmFzZWxpbmU7IGZvbnQtZmFtaWx5OiAnTGliZXJhdGlvbiBTYW5zJywgJ0x1eGkgU2Fucycs
ICdUcmVidWNoZXQgTVMnLCAnQml0c3RyZWFtIFZlcmEgU2FucycsIGhlbHZldGljYSwgdmVyZGFu
YSwgYXJpYWwsIHNhbnMtc2VyaWY7IHdoaXRlLXNwYWNlOiBwcmU7IG92ZXJmbG93LXg6IGF1dG87
IHdpZHRoOiBhdXRvOyB3b3JkLXdyYXA6IG5vcm1hbDsgY29sb3I6IHJnYig1MSwgNTEsIDUxKTsg
Zm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQ6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5v
cm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgbGluZS1oZWlnaHQ6IDE4cHg7IG9ycGhhbnM6
IDI7IHRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBu
b25lOyB3aWRvd3M6IDI7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc2l6ZS1hZGp1
c3Q6IGF1dG87IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgYmFja2dyb3VuZC1wb3Np
dGlvbjogaW5pdGlhbCBpbml0aWFsOyBiYWNrZ3JvdW5kLXJlcGVhdDogcmVwZWF0IHJlcGVhdDsg
Ij48Y29kZSBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjogdHJhbnNwYXJlbnQ7IGZvbnQtc2l6ZTog
MTFweDsgYm9yZGVyOiAwcHg7IG1hcmdpbjogMHB4OyBwYWRkaW5nOiAwcHg7IHZlcnRpY2FsLWFs
aWduOiBiYXNlbGluZTsgb3ZlcmZsb3cteDogYXV0bzsgd2hpdGUtc3BhY2U6IHByZTsgd2lkdGg6
IQogIGF1dG87IHdvcgpkLXdyYXA6IG5vcm1hbDsgYmFja2dyb3VuZC1wb3NpdGlvbjogaW5pdGlh
bCBpbml0aWFsOyBiYWNrZ3JvdW5kLXJlcGVhdDogaW5pdGlhbCBpbml0aWFsOyAiPiAgYXV0aCAg
ICAgICAgcmVxdWlyZWQgICAgICBwYW1fZW52LnNvCiA8Yj4gYXV0aCAgICAgICAgcmVxdWlyZWQg
ICAgICBwYW1fZmFpbGxvY2suc28gcHJlYXV0aCBzaWxlbnQgYXVkaXQgZGVueT0zIGV2ZW5fZGVu
eV9yb290IHVubG9ja190aW1lPTkwMCByb290X3VubG9ja190aW1lPTwvYj48Yj45MDA8L2I+CiAg
YXV0aCAgICAgICAgc3VmZmljaWVudCAgICBwYW1fdW5peC5zbyBudWxsb2sgdHJ5X2ZpcnN0X3Bh
c3MKICA8Yj5hdXRoICAgICAgICBbZGVmYXVsdD1kaWVdIHBhbV9mYWlsbG9jay5zbyBhdXRoZmFp
bCBhdWRpdCBkZW55PTMKICBhdXRoICAgICAgICBzdWZmaWNpZW50IHBhbV9mYWlsbG9jay5zbyBh
dXRoc3VjYyBhdWRpdCBkZW55PTM8L2I+CiAgYXV0aCAgICAgICAgcmVxdWlzaXRlICAgICBwYW1f
c3VjY2VlZF9pZi5zbyB1aWQgJmd0Oz0gNTAwIHF1aWV0CiAgYXV0aCAgICAgICAgcmVxdWlyZWQg
ICAgICBwYW1fZGVueS5zbwoKIDxiPiBhY2NvdW50ICAgICByZXF1aXJlZCAgICAgIHBhbV9mYWls
bG9jay5zbzwvYj4KICBhY2NvdW50ICAgICByZXF1aXJlZCAgICAgIHBhbV91bml4LnNvCiAgYWNj
b3VudCAgICAgc3VmZmljaWVudCAgICBwYW1fbG9jYWx1c2VyLnNvCiAgYWNjb3VudCAgICAgc3Vm
ZmljaWVudCAgICBwYW1fc3VjY2VlZF9pZi5zbyB1aWQgJmx0OyA1MDAgcXVpZXQKICBhY2NvdW50
ICAgICByZXF1aXJlZCAgICAgIHBhbV9wZXJtaXQuc28KCiAgcGFzc3dvcmQgICAgcmVxdWlzaXRl
ICAgICBwYW1fY3JhY2tsaWIuc28gdHJ5X2ZpcnN0X3Bhc3MgcmV0cnk9MyB0eXBlPQogIHBhc3N3
b3JkICAgIHN1ZmZpY2llbnQgICAgcGFtX3VuaXguc28gc2hhNTEyIHNoYWRvdyBudWxsb2sgdHJ5
X2ZpcnN0X3Bhc3MgdXNlX2F1dGh0b2sKICBwYXNzd29yZCAgICByZXF1aXJlZCAgICAgIHBhbV9k
ZW55LnNvCgogIHNlc3Npb24gICAgIG9wdGlvbmFsICAgICAgcGFtX2tleWluaXQuc28gcmV2b2tl
CiAgc2Vzc2lvbiAgICAgcmVxdWlyZWQgICAgICBwYW1fbGltaXRzLnNvCiAgc2Vzc2lvbiAgICAg
b3B0aW9uYWwgICAgICBwYW1fb2Rkam9iX21raG9tZWRpci5zbyBkZWJ1ZwogIHNlc3Npb24gICAg
IFtzdWNjZXNzPTEgZGVmYXVsdD1pZ25vcmVdIHBhbV9zdWNjZWVkX2lmLnNvIHNlcnZpY2UgaW4g
Y3JvbmQgcXVpZXQgdXNlX3VpZAogIHNlc3Npb24gICAgIHJlcXVpcmVkICAgICAgcGFtX3VuaXgu
c288L2NvZGU+PC9wcmU+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgPC9i
b2R5Pgo8L2h0bWw+Cg==

--===============0501983196206512504==--