Red Hat Security: Linux in Physical, Virtual, and Cloud

Review the PAM configuration file for the sshd service.

1. Log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

2. Display the content of the /etc/pam.d/sshd file. The sshd daemon uses that file to authenticate users who log in using SSH.

   [student@serverc ~]$ cat /etc/pam.d/sshd
   #%PAM-1.0
   auth	     required	    pam_sepermit.so
   auth       substack     password-auth
   auth       include      postlogin
   # Used with polkit to reauthorize users in remote sessions
   -auth      optional     pam_reauthorize.so prepare
   account    required     pam_nologin.so
   account    include      password-auth
   password   include      password-auth
   # pam_selinux.so close should be the first session rule
   session    required     pam_selinux.so close
   session    required     pam_loginuid.so
   # pam_selinux.so open should only be followed by sessions to be executed in the user context
   session    required     pam_selinux.so open env_params
   session    required     pam_namespace.so
   session    optional     pam_keyinit.so force revoke
   session    include      password-auth
   session    include      postlogin
   # Used with polkit to reauthorize users in remote sessions
   -session   optional     pam_reauthorize.so prepare

3. During the user authentication phase, sshd uses libpam functions to execute the modules from the auth management group. From the previous output, you can see that PAM calls:

   1. The pam_sepermit module to deny or allow access depending on the SELinux mode. You can get more details on this module in its manual page.

   2. The substack control jumps to the /etc/pam.d/password-auth file. If a requisite module fails or if a sufficient module succeeds in this password-auth file, PAM carries on with the remainder of the current /etc/pam.d/sshd file.

   3. The include control jumps to the /etc/pam.d/postlogin file. If a requisite module fails or if a sufficient module succeeds in this postlogin file, PAM gives control back to the sshd daemon.

   4. The result of the pam_reauthorize module does not matter because the control is set to optional. PAM silently skips this rule if the module is not installed, because auth is prefixed with a "-" character.

   Verify that the last module does not exist on your system.

   [student@serverc ~]$ ls /usr/lib64/security/pam_reauthorize.so
   ls: cannot access /usr/lib64/security/pam_reauthorize.so: No such file or directory

4. With the substack control in the /etc/pam.d/sshd configuration file, PAM includes all the rules from the /etc/pam.d/password-auth file. Many applications on the system share this file. This allows easy and consistent management of standard authentication tests for the whole system.

   Display the contents of the /etc/pam.d/password-auth file.

   [student@serverc ~]$ cat /etc/pam.d/password-auth
   #%PAM-1.0
   # This file is auto-generated.
   # User changes will be destroyed the next time authconfig is run.
   auth        required      pam_env.so
   auth        required      pam_faildelay.so
   auth        sufficient    pam_unix.so nullok try_first_pass
   auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
   auth        required      pam_deny.so
   
   account     required      pam_unix.so
   account     sufficient    pam_localuser.so
   account     sufficient    pam_succeed_if.so uid < 1000 quiet
   account     required      pam_permit.so
   
   password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
   password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
   
   
   password    required      pam_deny.so
   
   session     optional      pam_keyinit.so revoke
   session     required      pam_limits.so
   -session    optional      pam_systemd.so
   session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
   session     required      pam_unix.so

Investigate and configure the pam_faildelay module.

1. From the previous output, you can see that one of the modules that PAM executes during the authentication phase is pam_faildelay. Consult the man page for this module for more information and how to configure it.

   [student@serverc ~]$ man pam_faildelay
   ...output omitted...

   When a user enters an incorrect password, pam_faildelay introduces a delay between retries. This helps protect against brute-force attacks on passwords.

   The pam_faildelay module man page describes two ways to modify the delay:

   • You can edit the /etc/pam.d/password-auth file to add the delay parameter to the pam_faildelay module.

   • You can specify a value for the FAIL_DELAY variable in the /etc/login.defs file.

2. Before changing this parameter, log in to localhost as student but provide an incorrect password. Measure the delay between retries.

   [student@serverc ~]$ ssh student@localhost
   The authenticity of host 'localhost (::1)' can't be established.
   ECDSA key fingerprint is SHA256:BMdnasLF5CBGg42Dx77nuXodXdI9dKoEBQGFK5O0HRI.
   ECDSA key fingerprint is MD5:9e:a8:ec:0c:86:d2:70:34:ef:5a:94:15:6d:48:73:db.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
   student@localhost's password: mywrongpassword
   Permission denied, please try again.
   student@localhost's password: mywrongpassword
   Permission denied, please try again.
   student@localhost's password: mywrongpassword
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

   You should notice a 3-second delay between password retries.

3. Set the retry delay to 10 seconds. Modifying the /etc/pam.d/password-auth PAM configuration file requires extra care. Red Hat recommends that you use the second method, which consists of specifying a value for the FAIL_DELAY variable in /etc/login.defs.

   Edit the /etc/login.defs file and set the FAIL_DELAY variable to 10. Use student as the password for the sudo command.

   [student@serverc ~]$ sudo vim /etc/login.defs
   [sudo] password for student: student
   ...output omitted...
   FAIL_DELAY 10

4. Try again to log in to localhost as student, again using an incorrect password. This time the delay between password retries is 10 seconds.

   [student@serverc ~]$ ssh student@localhost
   student@localhost's password: mywrongpassword
   Permission denied, please try again.
   student@localhost's password: mywrongpassword
   Permission denied, please try again.
   student@localhost's password: mywrongpassword
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

Install Cockpit and verify that the package installs the PAM configuration file for the new software.

1. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

2. Install the cockpit package and start the service.

   [root@serverc ~]# yum install cockpit
   ...output omitted...
   Is this ok [y/d/N]: y
   ...output omitted...
   Complete!
   [root@serverc ~]# systemctl enable cockpit --now
   [root@serverc ~]# 

3. The Cockpit web interface listens on port 9090. Open the firewall.

   [root@serverc ~]# firewall-cmd --add-service cockpit
   success
   [root@serverc ~]# firewall-cmd --add-service cockpit --permanent
   success

4. Display the contents of the /etc/pam.d/cockpit file and confirm that it is part of the Cockpit packages.

   [root@serverc ~]# cat /etc/pam.d/cockpit
   #%PAM-1.0
   auth	   required	pam_sepermit.so
   auth       substack     password-auth
   auth       include      postlogin
   auth       optional     pam_ssh_add.so
   account    required     pam_nologin.so
   account    required     pam_shells.so
   account    include      password-auth
   password   include      password-auth
   # pam_selinux.so close should be the first session rule
   session    required     pam_selinux.so close
   session    required     pam_loginuid.so
   # pam_selinux.so open should only be followed by sessions to be executed in the user context
   session    required     pam_selinux.so open env_params
   session    optional     pam_keyinit.so force revoke
   session    optional     pam_ssh_add.so
   session    include      password-auth
   session    include      postlogin
   [root@serverc ~]# yum provides /etc/pam.d/cockpit
   ...output omitted...
   cockpit-ws-154-3.el7.x86_64 : Cockpit Web Service
   Repo        : rhel--server-dvd
   Matched from:
   Filename    : /etc/pam.d/cockpit
   ...output omitted...

5. In the same way that the sshd PAM configuration file includes the password-auth file, the /etc/pam.d/cockpit file also includes that file. Therefore, the delay between failed logins you previously configured should also apply to Cockpit.

   To confirm that delay, start Firefox on workstation and browse to the Cockpit web interface at https://serverc:9090/. Accept the self-signed certificate on the "Insecure Connection" page.

   On the Cockpit login page, enter student for the User name and an incorrect password in the Password field. Click Log In. After 10 seconds, the login page displays an error message and prompts the user to enter the password again.