On Monday, October 22, 2012 11:03:24 AM David Smith wrote:
Does anyone have definitive documentation on proper implementation
of
pam_faillock that will serve our purposes here?
For common criteria, it was put in /etc/pam.d/system-auth-ac, which
can be overwritten. It was used like this:
auth [default=die] pam_faillock.so authfail unlock_time=604800 root_unlock_time=900
You could place it in the entry points, too: login, remote, sshd, gdm, kdm,
xdm, vsftpd... but its probably easier to just put it in system-auth and make
sure its never tampered with by running periodic scans.
You have to be careful that nothing before it is labelled as sufficient. When
something is sufficient, then pam stops processing and returns its answer to
the app. So, in our setup, we changed pam_unix from this:
auth sufficient pam_unix.so nullok try_first_pass
into this:
auth [success=1 default=bad] pam_unix.so nullok try_first_pass
pam.conf(5) explains the options inside the [ ].
-Steve