0

I followed the information below, however, it is strangely blocking me from entering a password upon entering the login prompt on the server:

To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using pam_faillock.so:

Add the following lines immediately below the pam_env.so statement in /etc/pam.d/system-auth:

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900

auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.

I should mention this is part of a post script on a kickstart disc, but that shouldn't cause any errors... Any thoughts? The exact line I am using is:

sed -i "/pam_fprintd.so/ i auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900\nauth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900" /etc/pam.d/system-auth

2
  • Did you find this tutorial on the Internet somewhere? May 27, 2014 at 15:46
  • This is the recommended remedy provided by a security scan I performed (with openscap). Do you have any suggestions?
    – kjbradley
    May 27, 2014 at 15:53

2 Answers 2

1

The DISA STIGs for RHEL 6 is a poor resource. Instead, consider the CIS RHEL 6 Security Guide.

This will even work for Winbind Active Directory Accounts and local root login. Then put your name and STIG ID if it helps you remember for future changes.

//# Modified By Jordi Rubalcaba STIG ID:    RHEL-06-000357
auth    required      pam_faillock.so preauth silent deny=3 even_deny_root unlock_time=604800 fail_interval=900
auth    [default=die] pam_faillock.so authfail deny=3 even_deny_root unlock_time=604800 fail_interval=900
//# Modified By Jordi Rubalcaba

//# Modified By Jordi Rubalcaba
account      required pam_faillock.so
0

I think what you have to do is flip the order. The [default=die] is causing all your attempts to count as bad attempts. The guide I am following has the [default=die] second. I can log on with local accounts; my issue is logging on with Active Directory accounts with these lines enabled. I comment them out and it all works fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .