so I am trying to accomplish something and I can't quite get it. I am trying to limit login attempts to 3 (via ssh, terminal or gui. After those 3 failed attempts, I want to lock the account for 1 hour.
I have two test accounts that were working normally before the changes:
user1 is an ldap account and
user2 is a local account with a set password
After making the changes on system-auth and password-auth suggested on the rhel site, I am unable to login at all. Luckily I did not modify the root account and I can still access the system, but I fail to udnerstand what went wrong.
password-auth are the same, this is the config I have:
auth required pam_env.so auth required pam_faillock.so preauth silent deny=3 unlock_time=3600 fail_interval=900 auth sufficient pam_unix.so nullok try_first_pass auth [default=die] pam_faillock.so authfail deny=3 unlock_time=3600 fail_interval=900 auth sufficient pam_faillock.so authsucc audit deny=3 auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_faillock.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5 password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_oddjob_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so
passwd -S user1 and it doesn't seem to be locked out,and under the logs all I can see is
Failed password for both accounts.
Can anyone guide me or point me to be able to accomplish what I want? I just want to enforce failed login attempts and the lockout timing.