LinuxQuestions.org - where to set maximum login retries and automatically lock users

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - where to set maximum login retries and automatically lock users (https://www.linuxquestions.org/questions/linux-security-4/where-to-set-maximum-login-retries-and-automatically-lock-users-714353/)

where to set maximum login retries and automatically lock users

Hi,

I am using CentOS 4.4. How can I set automatic locking of password after 3 times login failure? Thanks.

Quote:

Originally Posted by depam (Post 3487347)

Hi,

I am using CentOS 4.4. How can I set automatic locking of password after 3 times login failure? Thanks.

From a brief Google search, this page may help you.
http://www.cyberciti.biz/tips/lock-u...-attempts.html

Quote:

Originally Posted by depam (Post 3487347)

Hi,

I am using CentOS 4.4. How can I set automatic locking of password after 3 times login failure? Thanks.

Locking accounts after three incorrect attempts isn't a good idea in many cases, are you sure this is the correct solution for your problem?

TBOne,

Should I have PAM enabled first? Is this a service that I need to incorporate with sshd? Thanks.

rweaver,

This is for compliance with our Audit. Thanks also.

HOPE THIS HELPS.
If failed login attempt 5 times then account will be locked and the unlock time will be 60 secs.

Code:

** Account auto unlock option is available in later versions of RHEL-4 Update 2. It has to be done manually. 



# vi /etc/pam.d/system-auth    [ This setting only works for RHEL- 5.x ]



auth        required      pam_env.so

auth        required      pam_tally.so onerr=fail deny=5 unlock_time=60

auth        sufficient    pam_unix.so nullok try_first_pass

auth        requisite    pam_succeed_if.so uid >= 500 quiet

auth        required      pam_deny.so



account    required      pam_unix.so



account    required      pam_tally.so reset

account    sufficient    pam_succeed_if.so uid < 500 quiet

account    required      pam_permit.so



password    requisite    pam_cracklib.so try_first_pass retry=3 minlen=8 lcredit=1 ucredit=1 dcredit=1 ocredit=1  



password    sufficient    pam_unix.so md5 remember=2 shadow nullok try_first_pass use_authtok

password    required      pam_deny.so



session    optional      pam_keyinit.so revoke

session    required      pam_limits.so

session    [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session    required      pam_unix.so

Thanks everyone. Its working now.

Actually .. having unlock_time using tally.so depends on what version of pam you're using..

In RHEL4, it is tally2.so that has unlock_time

Also, if using traditional / older version make sure you use no_magic_root ... read the man pages on pam to make sure you don't leave your machine unusable