faillock related descriptions are wrong and dangerous
Jeremiah Jahn
jeremiah at goodinassociates.com
Sun Aug 10 03:27:59 UTC 2014
That might make the test easier. Otherwise it's going to be fairly complicated to ensure the all of the pieces are in the right spot. Although I think even with your suggestion the pre-auth is still required in the auth section prior to pam_unix.
> On Aug 8, 2014, at 15:17, "Kayse, Josh" <Joshua.Kayse at gtri.gatech.edu> wrote:
>
>
>> On Aug 8, 2014, at 3:35 PM, Jeremiah Jahn <jeremiah at goodinassociates.com> wrote:
>>
>> accounts_passwords_pam_fail_interval and
>> accounts_passwords_pam_faillock_unlock_time have bad description
>>
>> The description needs to be changed in these from currently telling
>> the user to put them under pam_env.so to under pam_unix.so.
>>
>> Also there are a number of things you have to do. And I'll walk though
>> this example so you can see.
>>
>> normal pam system-auth file, same allied for password file
>> auth required pam_env.so
>> auth [success=1 default=bad] pam_unix.so
>> auth [default=die] pam_faillock.so authfail deny=3
>> even_deny_root unlock_time=604800 fail_interval=900
>> auth sufficient pam_faillock.so authsucc deny=3
>> even_deny_root unlock_time=604800 fail_interval=900
>> auth requisite pam_succeed_if.so uid >= 500 quiet
>> auth required pam_deny.so
>>
>> fist things first. you must skip the authfail on a successful login,
>> and set default equal to bad. the faillock authfail will ALWAYS lock
>> the user out if run. Which is why if you follow the guidance, you'll
>> brick your machine. so pam_unix.so must be set to [success=1
>> default=bad].
>>
>> second pam_faillock.so authsucc must be set to sufficient, and always
>> placed before pam_deny.
>>
>> your description currently says required, but you've got to alter
>> unix.so to fall through on success instead of simply being sufficient,
>> so now pam_faillock.so authsucc has to be sufficient to pick up the
>> slack. The test for this is also going to have to be rewritten as
>> well.
>>
>> -jj-
>
> Thanks for this information.
>
> An alternative to this dire situation is to include:
>
> account required pam_faillock.so
>
>
> -josh
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
More information about the scap-security-guide
mailing list