Is there any PAM module can do this ?

dmak168 · 09-01-2008, 09:18 PM

Hi All

Does anyone knows whether the following statement is possible to achieve with PAM modules ? I know pam_tally deny can be used to set max. unsuccessful login but it doe not have the ability to check if the unsuccessful attemps are within 60 minutes or not.

"User accounts shall be locked out after three unsuccessful login attempts within a 60 minute time period"

Thanks,
David

blacky_5251 · 09-01-2008, 11:46 PM

I think you can do it using PAM to track the number of login failures, and submit "/usr/bin/faillog -r" to run hourly using cron. Use man pam_tally and man faillog to get more detailed info. If you're using faillog to reset the tally of failed logins each hour, then you should also not reset the tally on successful login - just decrement the tally instead (this is a pam_tally option).

dmak168 · 09-02-2008, 11:15 AM

Thanks a lot for your answer ... I thought about using cron before but I believe it cannot do the job. For instance, the cron job can star right after your 2nd attemp if it falls into the 60 minutes boundary.

Thanks,
David