[PATCH] [bugfix] ticket 377: RHEL-06-000061 breaks sudo

Shawn Wells shawn.d.wells at gmail.com
Fri Mar 15 00:43:15 UTC 2013


-------------- next part --------------
>From 6313df4be6a0c8a24188649ea9da3244d964c6b0 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 14 Mar 2013 20:40:15 -0400
Subject: [PATCH] [bugfix] ticket 377: RHEL-06-000061 breaks sudo
 Corrected location to place pam_faillock within the system-auth config file

Previously, sudo would result in an immediate "invalid password" error and prevent GNOME logins

Thank you to Michael D. for reporting, and Leland S. for the fix!
---
 RHEL6/input/system/accounts/pam.xml |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 3a11bef..0253b48 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -395,7 +395,8 @@ and a second to use unlock_time and set it to a Value
 To configure the system to lock out accounts after a number of incorrect login
 attempts using <tt>pam_faillock.so</tt>:
 <br /><br />
-Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth</tt>:
+Add the following lines immediately below the <tt>pam_unix.so</tt> statement in <tt>AUTH</tt> section of
+<tt>/etc/pam.d/system-auth</tt>:
 <pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
 <pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
 </description>
-- 
1.7.1



More information about the scap-security-guide mailing list