[PATCH] changed pam_tally2 to pam_faillock

Shawn Wells shawn at redhat.com
Tue Oct 23 20:01:55 UTC 2012


On 10/23/12 8:59 AM, David Smith wrote:
> Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
> ---
>   RHEL6/input/system/accounts/pam.xml |   13 ++++++-------
>   1 files changed, 6 insertions(+), 7 deletions(-)
>
> diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
> index 21bb8d1..64b6045 100644
> --- a/RHEL6/input/system/accounts/pam.xml
> +++ b/RHEL6/input/system/accounts/pam.xml
> @@ -365,18 +365,17 @@ and a second to use unlock_time and set it to a Value
>   <title>Set Deny For Failed Password Attempts</title>
>   <description>
>   To configure the system to lock out accounts after a number of incorrect login
> -attempts using <tt>pam_tally2.so</tt>:
> +attempts using <tt>pam_faillock.so</tt>:
>   <br /><br />
> -Add the following line immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth-ac</tt> and <tt>/etc/pam.d/password-auth</tt>:
> -<pre>auth required pam_tally2.so deny=3 onerr=fail unlock_time=900</pre>
> +Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth-ac</tt>:
> +<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900</pre>
> +<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=900</pre>

I see Jeff already ack'd this, but per vendor documentation at 
https://access.redhat.com/knowledge/solutions/62949 this should be 
changed to read:


Change /etc/pam.d/system-auth & /etc/pam.d/password-auth to read as follows:

|   auth        required      pam_env.so
  *  auth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=900 root_unlock_time=**900*
   auth        sufficient    pam_unix.so nullok try_first_pass
   *auth        [default=die] pam_faillock.so authfail audit deny=3
   auth        sufficient pam_faillock.so authsucc audit deny=3*
   auth        requisite     pam_succeed_if.so uid >= 500 quiet
   auth        required      pam_deny.so

  *  account     required      pam_faillock.so*
   account     required      pam_unix.so
   account     sufficient    pam_localuser.so
   account     sufficient    pam_succeed_if.so uid < 500 quiet
   account     required      pam_permit.so

   password    requisite     pam_cracklib.so try_first_pass retry=3 type=
   password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
   password    required      pam_deny.so

   session     optional      pam_keyinit.so revoke
   session     required      pam_limits.so
   session     optional      pam_oddjob_mkhomedir.so debug
   session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
   session     required      pam_unix.so|





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121023/a5c6be4a/attachment-0001.html>


More information about the scap-security-guide mailing list