rhel7. Unlocking User Accounts After Password Failures

jmenengo · 04-30-2015, 03:22 AM

With redhat 7, the command for unlocking an user is
faillock --user <username> --reset
But I don't find how to know if a user is locked.
I can find in "/var/log/seucre"

grep user1 /var/log/secure
Apr 30 10:10:45 maquina1 sshd[12321]: pam_faillock(sshd:auth): Consecutive login failures for user user1 account temporarily locked

But I ask myself if there is a command or any way to see this easier.

Thanks

Ztcoracat · 04-30-2015, 08:49 PM

Try this link from Red Hat:

https://access.redhat.com/documentat...er-unlock.html

This second link may work but you should call Red Hat first and make sure if you should use this.
http://www.redhat.com/en/about/contact

http://sharadchhetri.com/2013/12/13/...ount-in-linux/

jmenengo · 05-01-2015, 02:27 AM

thanks for the reply, but I think that is only valid for redhat 6.
The problem is with redhat7 or CentOs7.
There are a many changes in this version and these commands don't work in rhel7.

sgrlscz · 05-01-2015, 06:43 AM

The faillock command without any arguments should list any locked accounts.

Ztcoracat · 05-01-2015, 09:33 PM

Quote:

Originally Posted by jmenengo

thanks for the reply, but I think that is only valid for redhat 6.
The problem is with redhat7 or CentOs7.
There are a many changes in this version and these commands don't work in rhel7.

Try reading through the documentation for RHEL 7 or give Red Hat a call.
https://access.redhat.com/documentat...prise_Linux/7/

jmenengo · 05-04-2015, 05:51 AM

The command
faillock --user nameuser
(without --reset)
displays the failed authentication attempts. This information comes
ls -l /var/run/faillock

cat /var/run/faillock/username

The number of attempts is defined in

/etc/pam.d/system-auth
/etc/pam.d/password-auth
auth required pam_faillock.so preauth silent audit deny=3

in this case "deny=3", the user is locked with 3 attempsts in this file /var/run/faillock/username
I think this is so ...

Ztcoracat · 05-04-2015, 08:20 PM

An account is unlocked using the user-unlock command.

Have you tried it?

https://access.redhat.com/documentat...er-unlock.html

http://www.linuxnix.com/2012/01/unlo...unt-linux.html
http://www.cyberciti.biz/faq/unlocki...ount-in-linux/
http://unixhelp.ed.ac.uk/CGI/man-cgi?passwd

ron7000 · 05-12-2015, 11:52 AM

you would think with what you have to pay for rhel to do something simple like this... would be simple.

i don't know how we ever survived before we locked out user accounts after 3 failed attempts

while your at it, to be safe better bump up minimum password length to 20 characters and have it expire every 30 days.

dyoung02 · 10-19-2021, 10:53 AM

You can use the passwd -S <username> command and look to see if LK appears next to the username.

TB0ne · 10-19-2021, 10:57 AM

Quote:

Originally Posted by dyoung02

You can use the passwd -S <username> command and look to see if LK appears next to the username.

Indeed; but this thread had been closed for six years already.

dyoung02 · 10-19-2021, 11:20 AM

Quote:

Originally Posted by TB0ne

Indeed; but this thread had been closed for six years already.

True, but the same way I came across it 6 years later for the faillock command I didn't see a direct answer to the original question so I figured I'd put it out there in case anyone else comes across this page looking for a direct answer to the original question.

JockVSJock · 11-11-2021, 04:26 AM

Quote:

Originally Posted by dyoung02

True, but the same way I came across it 6 years later for the faillock command I didn't see a direct answer to the original question so I figured I'd put it out there in case anyone else comes across this page looking for a direct answer to the original question.

I just learned something that I didn't know, from this old thread.

thanks