<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/23/12 8:59 AM, David Smith wrote:<br>
    </div>
    <blockquote
      cite="mid:1350997168-24504-2-git-send-email-dsmith@eclipse.ncsc.mil"
      type="cite">
      <pre wrap="">
Signed-off-by: David Smith <a class="moz-txt-link-rfc2396E" href="mailto:dsmith@eclipse.ncsc.mil">&lt;dsmith@eclipse.ncsc.mil&gt;</a>
---
 RHEL6/input/system/accounts/pam.xml |   13 ++++++-------
 1 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 21bb8d1..64b6045 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -365,18 +365,17 @@ and a second to use unlock_time and set it to a Value
 &lt;title&gt;Set Deny For Failed Password Attempts&lt;/title&gt;
 &lt;description&gt;
 To configure the system to lock out accounts after a number of incorrect login
-attempts using &lt;tt&gt;pam_tally2.so&lt;/tt&gt;:
+attempts using &lt;tt&gt;pam_faillock.so&lt;/tt&gt;:
 &lt;br /&gt;&lt;br /&gt;
-Add the following line immediately below the &lt;tt&gt;pam_env.so&lt;/tt&gt; statement in &lt;tt&gt;/etc/pam.d/system-auth-ac&lt;/tt&gt; and &lt;tt&gt;/etc/pam.d/password-auth&lt;/tt&gt;:
-&lt;pre&gt;auth required pam_tally2.so deny=3 onerr=fail unlock_time=900&lt;/pre&gt;
+Add the following lines immediately below the &lt;tt&gt;pam_env.so&lt;/tt&gt; statement in &lt;tt&gt;/etc/pam.d/system-auth-ac&lt;/tt&gt;:
+&lt;pre&gt;auth [default=die] pam_faillock.so authfail deny=3 unlock_time=900&lt;/pre&gt;
+&lt;pre&gt;auth required pam_faillock.so authsucc deny=3 unlock_time=900&lt;/pre&gt;</pre>
    </blockquote>
    <br>
    I see Jeff already ack'd this, but per vendor documentation at
    <a class="moz-txt-link-freetext" href="https://access.redhat.com/knowledge/solutions/62949">https://access.redhat.com/knowledge/solutions/62949</a> this should be
    changed to read:<br>
    <br>
    <br>
    Change /etc/pam.d/system-auth &amp; /etc/pam.d/password-auth to read
    as follows:<br>
    <meta charset="utf-8">
    <pre style="background-color: white; font-size: 13px; border-width: 1px 1px 1px 2px; border-style: solid; border-color: rgb(238, 238, 238) rgb(238, 238, 238) rgb(238, 238, 238) rgb(204, 204, 204); margin: 10px 20px; padding: 10px; vertical-align: baseline; font-family: 'Liberation Sans', 'Luxi Sans', 'Trebuchet MS', 'Bitstream Vera Sans', helvetica, verdana, arial, sans-serif; white-space: pre; overflow-x: auto; width: auto; word-wrap: normal; color: rgb(51, 51, 51); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 18px; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-position: initial initial; background-repeat: repeat repeat; "><code style="background-color: transparent; font-size: 11px; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline; overflow-x: auto; white-space: pre; width:!
  auto; wor
d-wrap: normal; background-position: initial initial; background-repeat: initial initial; ">  auth        required      pam_env.so
 <b> auth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=900 root_unlock_time=</b><b>900</b>
  auth        sufficient    pam_unix.so nullok try_first_pass
  <b>auth        [default=die] pam_faillock.so authfail audit deny=3
  auth        sufficient pam_faillock.so authsucc audit deny=3</b>
  auth        requisite     pam_succeed_if.so uid &gt;= 500 quiet
  auth        required      pam_deny.so

 <b> account     required      pam_faillock.so</b>
  account     required      pam_unix.so
  account     sufficient    pam_localuser.so
  account     sufficient    pam_succeed_if.so uid &lt; 500 quiet
  account     required      pam_permit.so

  password    requisite     pam_cracklib.so try_first_pass retry=3 type=
  password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
  password    required      pam_deny.so

  session     optional      pam_keyinit.so revoke
  session     required      pam_limits.so
  session     optional      pam_oddjob_mkhomedir.so debug
  session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
  session     required      pam_unix.so</code></pre>
    <br>
    <br>
    <br>
    <br>
  </body>
</html>