Red Hat Security: Linux in Physical, Virtual, and Cloud

The system must lock accounts with excessive failed login attempts. You must configure the pam_faillock module to set a limit of five failed attempts in a 15-minute interval. The system must automatically unlock locked accounts after 15 minutes. These restrictions do not apply to the root account.

1. Log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

3. Confirm that the default PAM configuration does not already include rules for the pam_faillock module.

   [root@serverc ~]# cd /etc/pam.d
   [root@serverc pam.d]# grep pam_faillock.so system-auth password-auth
   [root@serverc pam.d]# 

4. Use the authconfig --help | grep faillock command to retrieve the options related to the pam_faillock module.

   [root@serverc pam.d]# authconfig --help | grep faillock
       --enablefaillock        enable account locking in case of too many consecutive authentication failures
       --disablefaillock       disable account locking on too many consecutive authentication failures
     --faillockargs=<options>
                           the pam_faillock module options

   The --faillockargs option specifies the restrictions to apply. Review the pam_faillock manual page to get the module parameters to use with --faillockargs.

   [root@serverc pam.d]# man pam_faillock
   ...output omitted...
    deny=n
        Deny access if the number of consecutive authentication failures
        for this user during the recent interval exceeds n. The default is
        3.
   
    fail_interval=n
        The length of the interval during which the consecutive
        authentication failures must happen for the user account lock out
        is n seconds. The default is 900 (15 minutes).
   
    unlock_time=n
        The access will be reenabled after n seconds after the lock out.
        The default is 600 (10 minutes).
   ...output omitted...

   The deny parameter defines the number of failed attempts, the fail_interval parameter defines in seconds the time interval for failed attempts, and unlock_time defines the unlock timeout in seconds.

5. Use the authconfig command to enable and configure the pam_faillock module. Set a limit of five failed attempts in a 15-minute interval. The system must automatically unlock locked accounts after 15 minutes. These restrictions do not apply to the root account.

   [root@serverc pam.d]# authconfig --enablefaillock \
   > --faillockargs="deny=5 fail_interval=900 unlock_time=900" --update
   ...output omitted...
   [root@serverc pam.d]# 

6. Review the rules that the previous authconfig command has added to the PAM configuration.

   [root@serverc pam.d]# grep pam_faillock.so system-auth password-auth
   system-auth:auth    required  pam_faillock.so preauth silent deny=5 fail_interval=900 unlock_time=900
   system-auth:auth    required  pam_faillock.so authfail deny=5 fail_interval=900 unlock_time=900
   system-auth:account required  pam_faillock.so
   password-auth:auth    required  pam_faillock.so preauth silent deny=5 fail_interval=900 unlock_time=900
   password-auth:account required  pam_faillock.so
   password-auth:auth    required  pam_faillock.so authfail deny=5 fail_interval=900 unlock_time=900

Verify that you meet the requirements by trying to log in to localhost as operator2 with an incorrect password. You must enter an incorrect password at least five times to lock the account.

1. Try to log in to localhost as operator2 using an incorrect password.

   [root@serverc pam.d]# ssh operator2@localhost
   operator2@localhost's password: wrongpass1
   Permission denied, please try again.
   operator2@localhost's password: wrongpass2
   Permission denied, please try again.
   operator2@localhost's password: wrongpass3
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
   [root@serverc pam.d]# ssh operator2@localhost
   operator2@localhost's password: wrongpass4
   Permission denied, please try again.
   operator2@localhost's password: wrongpass5
   Permission denied, please try again.
   operator2@localhost's password: wrongpass6
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

2. To confirm that the account is locked, try to log in to localhost as operator2 but this time use the correct password, redhat.

   [root@serverc pam.d]# ssh operator2@localhost
   operator2@localhost's password: redhat
   Permission denied, please try again.
   operator2@localhost's password: redhat
   Permission denied, please try again.
   operator2@localhost's password: redhat
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

3. Use the faillock --user operator2 command to list the invalid login attempts.

   [root@serverc pam.d]# faillock --user operator2
   operator2:
   When                Type  Source                                 Valid
   2018-07-12 18:42:22 RHOST localhost                                  V
   2018-07-12 18:42:25 RHOST localhost                                  V
   2018-07-12 18:42:29 RHOST localhost                                  V
   2018-07-12 18:42:35 RHOST localhost                                  V
   2018-07-12 18:42:40 RHOST localhost                                  V

   Because you configured pam_faillock to lock accounts after five failed attempts, the operator2 account is now locked.

Unlock the operator2 account and confirm that the user can log in again.

1. Use the faillock --user operator2 --reset command to unlock the account.

   [root@serverc pam.d]# faillock --user operator2 --reset
   [root@serverc pam.d]# 

2. Use the faillock --user operator2 command to confirm that the account is unlocked.

   [root@serverc pam.d]# faillock --user operator2
   operator2:
   When                Type  Source                                 Valid

3. Log in to localhost as operator2 using redhat as the password to verify that the account is unlocked. Log out when done.

   [root@serverc pam.d]# ssh operator2@localhost
   operator2@localhost's password: redhat
   Last failed login: Thu Jul 12 18:52:12 EDT 2018 from localhost on ssh:notty
   There were 9 failed login attempts since the last successful login.
   Last login: Thu Jul 12 18:42:16 2018 from localhost
   [operator2@serverc ~]$ logout
   [root@serverc pam.d]# 

4. Disable the pam_faillock module. Log out from serverc when done.

   [root@serverc pam.d]# authconfig --disablefaillock --update
   [root@serverc pam.d]# logout
   [student@serverc ~]$ logout
   [student@workstation ~]$