I followed the information below, however, it is strangely blocking me from entering a password upon entering the login prompt on the server:

To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using pam_faillock.so:

Add the following lines immediately below the pam_env.so statement in /etc/pam.d/system-auth:

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900

auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900

Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.

I should mention this is part of a post script on a kickstart disc, but that shouldn't cause any errors... Any thoughts? The exact line I am using is:

sed -i "/pam_fprintd.so/ i auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900\nauth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900" /etc/pam.d/system-auth

  • Did you find this tutorial on the Internet somewhere? – Michael Hampton May 27 '14 at 15:46
  • This is the recommended remedy provided by a security scan I performed (with openscap). Do you have any suggestions? – kjbradley May 27 '14 at 15:53

The DISA STIGs for RHEL 6 is a poor resource. Instead, consider the CIS RHEL 6 Security Guide.

This will even work for Winbind Active Directory Accounts and local root login. Then put your name and STIG ID if it helps you remember for future changes.

//# Modified By Jordi Rubalcaba STIG ID:    RHEL-06-000357
auth    required      pam_faillock.so preauth silent deny=3 even_deny_root unlock_time=604800 fail_interval=900
auth    [default=die] pam_faillock.so authfail deny=3 even_deny_root unlock_time=604800 fail_interval=900
//# Modified By Jordi Rubalcaba

//# Modified By Jordi Rubalcaba
account      required pam_faillock.so

I think what you have to do is flip the order. The [default=die] is causing all your attempts to count as bad attempts. The guide I am following has the [default=die] second. I can log on with local accounts; my issue is logging on with Active Directory accounts with these lines enabled. I comment them out and it all works fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.