<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/23/12 8:59 AM, David Smith wrote:<br>
</div>
<blockquote
cite="mid:1350997168-24504-2-git-send-email-dsmith@eclipse.ncsc.mil"
type="cite">
<pre wrap="">
Signed-off-by: David Smith <a class="moz-txt-link-rfc2396E" href="mailto:dsmith@eclipse.ncsc.mil"><dsmith@eclipse.ncsc.mil></a>
---
RHEL6/input/system/accounts/pam.xml | 13 ++++++-------
1 files changed, 6 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 21bb8d1..64b6045 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -365,18 +365,17 @@ and a second to use unlock_time and set it to a Value
<title>Set Deny For Failed Password Attempts</title>
<description>
To configure the system to lock out accounts after a number of incorrect login
-attempts using <tt>pam_tally2.so</tt>:
+attempts using <tt>pam_faillock.so</tt>:
<br /><br />
-Add the following line immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth-ac</tt> and <tt>/etc/pam.d/password-auth</tt>:
-<pre>auth required pam_tally2.so deny=3 onerr=fail unlock_time=900</pre>
+Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth-ac</tt>:
+<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900</pre>
+<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=900</pre></pre>
</blockquote>
<br>
I see Jeff already ack'd this, but per vendor documentation at
<a class="moz-txt-link-freetext" href="https://access.redhat.com/knowledge/solutions/62949">https://access.redhat.com/knowledge/solutions/62949</a> this should be
changed to read:<br>
<br>
<br>
Change /etc/pam.d/system-auth & /etc/pam.d/password-auth to read
as follows:<br>
<meta charset="utf-8">
<pre style="background-color: white; font-size: 13px; border-width: 1px 1px 1px 2px; border-style: solid; border-color: rgb(238, 238, 238) rgb(238, 238, 238) rgb(238, 238, 238) rgb(204, 204, 204); margin: 10px 20px; padding: 10px; vertical-align: baseline; font-family: 'Liberation Sans', 'Luxi Sans', 'Trebuchet MS', 'Bitstream Vera Sans', helvetica, verdana, arial, sans-serif; white-space: pre; overflow-x: auto; width: auto; word-wrap: normal; color: rgb(51, 51, 51); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 18px; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-position: initial initial; background-repeat: repeat repeat; "><code style="background-color: transparent; font-size: 11px; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline; overflow-x: auto; white-space: pre; width:!
auto; wor
d-wrap: normal; background-position: initial initial; background-repeat: initial initial; "> auth required pam_env.so
<b> auth required pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=900 root_unlock_time=</b><b>900</b>
auth sufficient pam_unix.so nullok try_first_pass
<b>auth [default=die] pam_faillock.so authfail audit deny=3
auth sufficient pam_faillock.so authsucc audit deny=3</b>
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
<b> account required pam_faillock.so</b>
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so debug
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so</code></pre>
<br>
<br>
<br>
<br>
</body>
</html>