0

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file :

#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faillock.so preauth silent audit deny=5 even_deny_root unlock_time=9999999 auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth [default=die] pam_faillock.so authfail audit deny=5 even_deny_root unlock_time=99999999 auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so auth required pam_tally.so onerr=succeed deny=5 even_deny_root_account account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so account required pam_faillock.so password requisite pam_cracklib.so try_first_pass retry=5 minlen=8 minclass=3 max_repeat=1 difok=5 dcredit=1 ucredit=1 lcredit=1 ocredit=1 maxrepeat=1 gecoscheck enforce_for_root type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so

This is the content of my /etc/pam.d/password-auth :

#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faillock.so preauth silent audit deny=5 unlock_time=99999 auth sufficient pam_unix.so nullok try_first_pass auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=99999 auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so account required pam_faillock.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so

I use CentOS 6.5, pam says that there is 0 failures. EDIT : The account is locked after 5 try but if I restart the computer, the account is unlocked... Why ?

Improve this question
2
  • Which distro you using? What version? And pam_tally2 --user "youraccountname' gives what? Commented Jan 9, 2019 at 10:33
  • PAM locks the account of a specific amount of time or until you restart the server as PAM is designed to lock the account temporaly, not permanently. Commented Jan 9, 2019 at 13:39

3 Answers 3

Reset to default
1

I suppose that you have restarted the system in order to apply all the changes, otherwise the login application could not be recognising the changes.

You have to also apply the restrictions in the /etc/pam.d/login file to be sure that PAM will block the access after unsuccessful logins in every cases as each PAM module has different purpouses.

login: Rules for local login.

system-auth: Common rules for many services.

password-auth: Common rules for many remote services.

sshd: Rules for SSHD daemon only.

Improve this answer
0

Your config looks correct as far as I can tell.

But if your using ssh to login, make sure UsePAM is set to yes in your sshd_config file. Otherwise all things PAM are ignored for ssh logins! And it defaults to no.

Improve this answer
1
  • No, I don't use ssh, I just want to block on CentOS login screen. Commented Jan 9, 2019 at 10:37
0

I finded the good order and good syntax. I make severals tests and finnaly it works. Maybe the problem was a typing error. So this is the PAM's parameters to block a user after 5 try on lock screen. The parameters contains also some rules to prevent too simple password changing.

Note : The counter is reset when computer restarts.

/etc/pam.d/system-auth :

#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faillock.so preauth silent audit deny=5 even_deny_root unlock_time=99999 auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=99999 auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so account required pam_faillock.so password requisite pam_cracklib.so try_first_pass retry=5 minlen=8 minclass=3 max_repeat=1 difok=5 dcredit=1 ucredit=1 lcredit=1 ocredit=1 maxrepeat=1 gecoscheck enforce_for_root type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so

Content of /etc/pam.d/password-auth :

#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faillock.so preauth silent audit deny=5 unlock_time=99999 auth sufficient pam_unix.so nullok try_first_pass auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=99999 auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so account required pam_faillock.so password requisite pam_cracklib.so try_first_pass retry=5 minlen=8 minclass=3 max_repeat=1 difok=5 dcredit=1 ucredit=1 lcredit=1 ocredit=1 maxrepeat=1 gecoscheck enforce_for_root type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.