Welcome to the Linux Foundation Forum!

Lab 9.2 Locking Accounts after Excessive Login Attempts

m.taniguchi Posts: 6
edited June 27 in LFS216 Class Forum

I think current contents of Lab 9.2 seems not to work in CentOS8 environment, and I think the contents should be updated.
At least,

  1. pam_tally2 is absolete, instead **pam_faillock **is recommended
  2. You shouldn't modify manually password-auth/system-auth files ( it's prohibited to do so in the files)
  3. You should use **authselect **command instead ( **authconfig **is an older command)

in short, It's better to excercise this Lab

  • Use pam_faillock **, not **pam_tally2
  • Use authselect and modify configuration _indirectly _

[What I did ]

  1. create authselect user profile from current sssd profile
[[email protected] ~]# authselect create-profile test-lab -b sssd (profile name is test-lab) 
  1. change the profile to above with faillock feature
[[email protected] ~]# authselect select custom/test-lab with-faillock without-nullok
[[email protected] ~]# authselect current 
Profile ID: custom/test-lab
Enabled features:
- with-faillock
- without-nullok
  1. change password-auth/system-auth indirectly
[[email protected] ~]#vim /etc/authselect/custom/test-lab/password-auth
[[email protected] ~]#vim /etc/authselect/custom/test-lab/system-auth 

i set deny counts to twice (deny=2), unlock_time to 0 (infinite) (see [Reference sites][1])

  1. apply above chaanges
[[email protected] ~]#authselect apply-changes 
  1. Try
    ( I already set password to failuser previously.)
[[email protected] ~]# ssh [email protected]
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

**Note : password prompt appears 3 times. this is sshd behavior not faillock's. if you change prompt number, you add option like;

ssh [email protected] -o 'NumberOfPasswordPrompts 5'

  1. Check by faillock
[[email protected] ~]# faillock 
When                Type  Source                                           Valid
2021-06-27 17:43:12 RHOST ::1                                                  V
2021-06-27 17:43:15 RHOST ::1                                                  V
When                Type  Source                                           Valid
When                Type  Source                                           Valid
When                Type  Source                                           Valid

the user "failuser" failes twice. this means the user locked. (BTW I don't know how to see the user is locked or not)

  1. Unlock the user
    [[email protected] ~]# faillock --user failuser --reset

[Reference sites]

[1] https://i66lab.com/User:xltran/App/CentOS/8/Administration/Authselect
[2] https://michaelpesa.com/posts/creating-custom-authselect-profiles/
[3] https://www.golinuxcloud.com/pam-faillock-lock-user-account-linux/


Upcoming Training