On 10/23/12 8:59 AM, David Smith wrote:
Signed-off-by: David Smith <dsmith(a)eclipse.ncsc.mil>
---
RHEL6/input/system/accounts/pam.xml | 13 ++++++-------
1 files changed, 6 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 21bb8d1..64b6045 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -365,18 +365,17 @@ and a second to use unlock_time and set it to a Value
<title>Set Deny For Failed Password Attempts</title>
<description>
To configure the system to lock out accounts after a number of incorrect login
-attempts using <tt>pam_tally2.so</tt>:
+attempts using <tt>pam_faillock.so</tt>:
<br /><br />
-Add the following line immediately below the <tt>pam_env.so</tt> statement
in <tt>/etc/pam.d/system-auth-ac</tt> and
<tt>/etc/pam.d/password-auth</tt>:
-<pre>auth required pam_tally2.so deny=3 onerr=fail unlock_time=900</pre>
+Add the following lines immediately below the <tt>pam_env.so</tt> statement
in <tt>/etc/pam.d/system-auth-ac</tt>:
+<pre>auth [default=die] pam_faillock.so authfail deny=3
unlock_time=900</pre>
+<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=900</pre>
I see Jeff already ack'd this, but per vendor documentation at
https://access.redhat.com/knowledge/solutions/62949 this should be
changed to read:
Change /etc/pam.d/system-auth & /etc/pam.d/password-auth to read as follows:
| auth required pam_env.so
* auth required pam_faillock.so preauth silent audit deny=3 even_deny_root
unlock_time=900 root_unlock_time=**900*
auth sufficient pam_unix.so nullok try_first_pass
*auth [default=die] pam_faillock.so authfail audit deny=3
auth sufficient pam_faillock.so authsucc audit deny=3*
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
* account required pam_faillock.so*
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so debug
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet
use_uid
session required pam_unix.so|