Bug in pam_faillock.so Section

Maura Dailey maura at eclipse.ncsc.mil
Tue Jul 2 17:00:21 UTC 2013


My own testing seems to indicate that the lines be after pam_sss.so, not 
pam_unix.so, if you are using networked accounts through LDAP or 
Kerberos. If you try to put it right after pam_unix.so, it will not work 
and you will be locked out. Otherwise, Red Hat's RHN guidance definitely 
works. I just don't know if I have to worry about 
/etc/pam.d/system-auth-ac or /etc/pam.d/password-auth.

On 07/02/2013 12:25 PM, Maura Dailey wrote:
> The guidance given in the pam_faillock.so section is probably wrong 
> and misleading.
>
> "Set Deny For Failed Password Attempts" says to insert the two lines 
> after the pam_unix.so auth line. However, "Set Lockout Time for Failed 
> Password Attempts" and "Set Interval For Counting Failed Password 
> Attempts" says to insert the same two lines after the pam_env.so line. 
> Not only is this a contradiction, it implies that the same two lines 
> much be added over and over again.
>
> The STIG has the same problem, except the STIG refers to 
> /etc/pam.d/system-auth-ac while our guide refers to 
> /etc/pam.d/system-auth.
>
> Red Hat's guidance shows four faillock lines, one after pam_env.so, 
> two after pam_unix.so, and one at the beginning of account: 
> https://access.redhat.com/site/solutions/62949 The Red Hat solution 
> also suggests editing /etc/pam.d/password-auth in addition to 
> /etc/pam.d/system-auth.
>
> Has anyone actually tested this guidance? I've made my own attempts on 
> our own RHEL network with only moderate success.
>
> - Maura Dailey
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list