Red Hat Security: Linux in Physical, Virtual, and Cloud

Bookmark this page
P123456789101112
PreviousNext

Limiting Access After Failed Logins

Objectives

After completing this section, students should be able to implement account locking after a specified number of failed logins.

Locking Accounts with Multiple Failed Logins

Many security policies have requirements related to locking user accounts after multiple failed login attempts. You can use the PAM pam_faillock module to implement this requirement. The pam_faillock module can lock accounts after a specific number of failed login attempts, and it can automatically unlock these accounts after a predefined period. You can use the faillock command, part of the pam package, to view a report of failed login attempts or to reset a user's failed attempts.

Note

The pam_faillock module was added in Red Hat Enterprise Linux 6.1, alongside the already existing pam_tally2 module. pam_faillock provides some extra functionality. For example, it also controls failed login attempts on local screen savers. The authconfig tool can configure pam_faillock but not pam_tally2.

You should be aware of the risk of denial-of-service attacks when enabling pam_faillock. A malicious user can easily lock an account by voluntarily entering incorrect passwords. The legitimate user will then be denied access to their account for the duration of the lock period.

Configuring password quality requirements

Configuring the pam_faillock Module

pam_faillock does not a have a dedicated configuration file; its configuration is entirely done through its arguments. To enable and configure pam_faillock, you can manually edit the PAM configuration files, but the authconfig tool offers a much easier way. 

[root@demo ~]# authconfig --enablefaillock \
> --faillockargs="deny=3 fail_interval=60 unlock_time=600" --update
[root@demo ~]#

The --enablefaillock option activates the pam_faillock module in your PAM configuration. The --faillockargs option configures the module. The pam_faillock(8) manual page describes all the available arguments, but the most common are listed below.

deny=N

This is the number of consecutive failed login attempts after which pam_faillock locks the account.

fail_interval=S

This is the time interval, specified in seconds, during which the failed login attempts must occur for pam_faillock to lock the account. In the previous example, with deny=3 and fail_interval=60, pam_faillock locks the account if the user enters three consecutive incorrect passwords in less than a minute.

unlock_time=S

This is the number of seconds after which PAM unlocks the account. In the previous example, with unlock_time=600, a user with a locked account must wait 10 minutes before being able to log in again.

even_deny_root

By default, without this argument, pam_faillock does not lock the root account. With the even_deny_root argument, pam_faillock applies the same rules to root as it does to regular users. Enabling this setting could have severe consequences. A malicious user can lock the root account, preventing legitimate administrators from accessing the system. To mitigate this issue, you can use the root_unlock_time=S argument to specify a shorter lock time for the root account. Red Hat recommends to deny direct remote root access to your system. For SSH, you can set PermitRootLogin to no in /etc/ssh/sshd_config.

PAM calls the pam_faillock module in the auth and account management groups. 

[root@demo ~]# cat /etc/pam.d/system-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        required      pam_faildelay.so delay=2000000
auth        required      pam_faillock.so preauth ...       1
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        required      pam_faillock.so authfail ...      2
auth        required      pam_deny.so

account     required      pam_faillock.so                   3
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     required      pam_permit.so
...output omitted...

1

First, PAM calls the module in the auth management group, before any other module that asks the user for their password, such as pam_unix. With the preauth argument, pam_faillock controls if the user account is locked.

2

PAM calls the module a second time in the auth management group, but this time, only if the user has entered an incorrect password. Notice that the pam_unix module is sufficient. This means that if the password is correct, PAM exits the file at that point and the following pam_faillock module is not called. With the authfail argument, pam_faillock records the failed login attempt.

3

PAM calls the module in the account management group. Because at this point the user is authenticated, pam_faillock invalidates the failed login attempt records for the account.

Managing Locked Accounts

You can list failed login attempts with the faillock command. 

[root@demo ~]# faillock
user1:
When                Type  Source               Valid
2018-07-14 11:46:35 RHOST 10.1.2.12                V
2018-07-14 11:46:31 RHOST 10.1.2.12                V
2018-07-14 11:46:44 RHOST 10.1.2.12                V
user2:
When                Type  Source               Valid
2018-07-14 11:48:01 TTY   tty2                     V
2018-07-14 11:48:31 TTY   tty2                     V
2018-07-14 11:48:37 TTY   tty2                     V
root:
When                Type  Source               Valid

The --user option restricts the output to a specific account. 

[root@demo ~]# faillock --user user1
user1:
When                Type  Source               Valid
2018-07-14 11:46:31 RHOST 10.1.2.12                V
2018-07-14 11:46:44 RHOST 10.1.2.12                V
2018-07-14 11:46:35 RHOST 10.1.2.12                V

The Type column indicates the source of the connection: RHOST for remote connections, such as ssh, or TTY for console connections. The Source column gives the origin of the connection: host name, IP address, or TTY. The Valid column indicates if the record is still valid (V) or not (I).

The --reset option removes the failure records for a user. As a side effect, this also unlocks the account if it was locked. 

[root@demo ~]# faillock --user user1 --reset
[root@demo ~]# faillock --user user1
user1:
When                Type  Source               Valid
[root@demo ~]#

References

The pam_faillock(8) and faillock(8) man pages.

For more information, refer to the Account Locking section in the Red Hat Enterprise Linux 7 Security Guide at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/security_guide/#sect-Security_Guide-Workstation_Security-Account_Locking

PreviousNext
Revision: rh415-7.5-813735c