All;

I've been working with the RHEL6 SSG (0.1.18-3) and found that the direction for using pam_faillock.so does not work. I know what is wrong with it but I see that the latest RHEL Beta package (0.1.21-2) decided to go a different way with the configuration. There are two possible faillock configurations shown in the pam_faillock man page. I was just curious about the relative merits of each and why the decision was made to use the "2nd" form rather than just fix the "1st".

Stack described in current RHEL6 SSG:
auth        sufficient    pam_unix.so nullok try_first_pass
auth        [default=die]    pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
auth        required           pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Per the man page the following modifications would need to be made:
auth        [success=1 default=bad]    pam_unix.so nullok try_first_pass
auth        [default=die]    pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
auth        sufficient           pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

-Lesley Kimmel