pam_faillock

Steve Grubb sgrubb at redhat.com
Mon Oct 22 18:54:30 UTC 2012


On Monday, October 22, 2012 02:46:07 PM Steve Grubb wrote:
> On Monday, October 22, 2012 11:03:24 AM David Smith wrote:
> > Does anyone have definitive documentation on proper implementation of
> > pam_faillock that will serve our purposes here?
> 
> For common criteria, it was put in /etc/pam.d/system-auth-ac, which
> can be overwritten. It was used like this:
> 
> auth    [default=die]   pam_faillock.so authfail unlock_time=604800 root_unlock_time=900

auth	  required	  pam_faillock.so authsucc unlock_time=604800 root_unlock_time=900

Oops...forgot the above line. Should be 2 pam_faillock lines, one for fail and
one for success.


> You could place it in the entry points, too: login, remote, sshd, gdm, kdm,
> xdm, vsftpd...  but its probably easier to just put it in system-auth and
> make sure its never tampered with by running periodic scans.
> 
> You have to be careful that nothing before it is labelled as sufficient.
> When something is sufficient, then pam stops processing and returns its
> answer to the app. So, in our setup, we changed pam_unix from this:
> 
> auth        sufficient    pam_unix.so nullok try_first_pass
> 
> into this:
> 
> auth	[success=1 default=bad]	pam_unix.so nullok try_first_pass
> 
> pam.conf(5) explains the options inside the [ ].
> 
> -Steve
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list