Red Hat Security: Linux in Physical, Virtual, and Cloud

Log in to serverd as student. No password is required.

[student@workstation ~]$ ssh student@serverd
[student@serverd ~]$ 

Use sudo -i to confirm that the command does not work.

[student@serverd ~]$ sudo -i
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts

Log out from serverd and log in again as root.

[student@serverd ~]$ logout
[student@workstation ~]$ ssh root@serverd
[root@serverd ~]# 

Troubleshoot your system by first reviewing the contents of the /etc/pam.d/sudo-i file. This is the PAM configuration file that the sudo -i command uses.

[root@serverd ~]# cd /etc/pam.d
[root@serverd pam.d]# cat sudo-i
#%PAM-1.0
auth       include      sudo
account    include      sudo
password   include      sudo
session    optional     pam_keyinit.so force revoke
session    required     pam_limits.so

The auth management group includes the sudo file.

Review the /etc/pam.d/sudo file.

[root@serverd pam.d]# cat sudo
#%PAM-1.0
auth       include      system-auth
account    include      system-auth
password   include      system-auth
session    optional     pam_keyinit.so revoke
session    required     pam_limits.so

The auth management group includes the system-auth file.

Review the /etc/pam.d/system-auth file.

[root@serverd pam.d]# cat system-auth
[root@serverd pam.d]# ls -l system-auth
lrwxrwxrwx. 1 root root 30 Jul 13 10:09 system-auth -> /etc/pam.d/system-auth-serverd
[root@serverd pam.d]# ls -l /etc/pam.d/system-auth-serverd
-rw-r--r--. 1 root root 0 Jul 13 10:09 /etc/pam.d/system-auth-serverd

The system-auth link points to an empty file. This is the cause of the error.

The easiest way to fix this issue is to recreate the link to the original system-auth-ac file.

[root@serverd pam.d]# rm system-auth
rm: remove symbolic link ‘system-auth’? y
[root@serverd pam.d]# ln -s system-auth-ac system-auth
[root@serverd pam.d]# 

Confirm the success of your correction by logging in as student and using the sudo -i command. Use student as the password for sudo.

[root@serverd pam.d]# logout
[student@workstation ~]$ ssh student@serverd
[student@serverd ~]$ sudo -i
[sudo] password for student: student
[root@serverd ~]# 

Confirm that the default PAM configuration already includes a rule that calls the pam_pwquality module.

[root@serverd ~]# cd /etc/pam.d
[root@serverd pam.d]# grep pam_pwquality.so system-auth password-auth
system-auth:password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password-auth:password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=

Edit the /etc/security/pwquality.conf file. Add the following parameters at the end.

[root@serverd ~]# vim /etc/security/pwquality.conf
...output omitted...
minlen = 15
ucredit = -1
lcredit = -1
dcredit = -1
ocredit = 0

The default value of ocredit is 1, so remember to set it to 0. Otherwise, you will be able to enter a 14 character password as long as it contains a special character. The special character gives one credit and reduces the password size by one.

Use the provided passwords to test your configuration on the architect1 user. The current password for architect1 is redhat.

[root@serverd pam.d]# su - architect1
[architect1@serverd ~]$ passwd
Changing password for user architect1.
Changing password for architect1.
(current) UNIX password: redhat
New password: I<3joulutorttu
BAD PASSWORD: The password is shorter than 15 characters
New password: Il0veGulabjamun
Retype new password: Il0veGulabjamun
passwd: all authentication tokens updated successfully.
[architect1@serverd ~]$ logout
[root@serverd pam.d]# 

To enable and configure the pam_faillock module, use the authconfig command with the --enablefaillock and --faillockargs options.

Remember that the authconfig command updates the system-auth-ac and password-auth-ac files. For PAM to take these files into account, make sure that the system-auth and password-auth links point to these *-ac files. If not, recreate the links.

[root@serverd pam.d]# ls -l system-auth password-auth
lrwxrwxrwx. 1 root root 32 Jul 13 10:09 password-auth -> /etc/pam.d/password-auth-serverd
lrwxrwxrwx. 1 root root 14 Jul 13 10:28 system-auth -> system-auth-ac
[root@serverd pam.d]# rm password-auth
rm: remove symbolic link ‘password-auth’? y
[root@serverd pam.d]# ln -s password-auth-ac password-auth
[root@serverd pam.d]# ls -l system-auth password-auth
lrwxrwxrwx. 1 root root 16 Jul 13 11:26 password-auth -> password-auth-ac
lrwxrwxrwx. 1 root root 14 Jul 13 10:28 system-auth -> system-auth-ac

If you plan to manually modify the PAM configuration it may be better to use custom files and include the *-ac files in those custom files.

Use the authconfig command to enable and configure the pam_faillock module. The fail_interval and unlock_time parameters are in seconds.

[root@serverd pam.d]# authconfig --enablefaillock \
> --faillockargs="even_deny_root deny=3 fail_interval=900 \
> unlock_time=604800" --update
[root@serverd pam.d]# 

Confirm that you meet the requirements by trying to log in to localhost as architect1 but using an incorrect password. Use the faillock command to verify that the pam_faillock module has locked the user account.

[root@serverd pam.d]# ssh architect1@localhost
ECDSA key fingerprint is SHA256:BMdnasLF5CBGg42Dx77nuXodXdI9dKoEBQGFK5O0HRI.
ECDSA key fingerprint is MD5:9e:a8:ec:0c:86:d2:70:34:ef:5a:94:15:6d:48:73:db.
Are you sure you want to continue connecting (yes/no)? yes
architect1@localhost's password: wrong1
Permission denied, please try again.
architect1@localhost's password: wrong2
Permission denied, please try again.
architect1@localhost's password: wrong3
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
[root@serverd pam.d]# faillock --user architect1
architect1:
When                Type  Source                                 Valid
2018-07-13 11:58:01 RHOST localhost                                  V
2018-07-13 11:58:04 RHOST localhost                                  V
2018-07-13 11:58:07 RHOST localhost                                  V

Install the SSSD packages.

[root@serverd pam.d]# yum install sssd
...output omitted...
Is this ok [y/d/N]: y
...output omitted...
Complete!

Use the authconfig command to enable SSSD for authentication.

[root@serverd pam.d]# authconfig --enablesssdauth --update
[root@serverd pam.d]# 

Confirm that authconfig has added the rules for pam_sss to the system-auth and password-auth files.

[root@serverd pam.d]# grep pam_sss.so system-auth password-auth
system-auth:auth        sufficient    pam_sss.so forward_pass
system-auth:account     [default=bad success=ok user_unknown=ignore] pam_sss.so
system-auth:password    sufficient    pam_sss.so use_authtok
system-auth:session     optional      pam_sss.so
password-auth:auth        sufficient    pam_sss.so forward_pass
password-auth:account     [default=bad success=ok user_unknown=ignore] pam_sss.so
password-auth:password    sufficient    pam_sss.so use_authtok
password-auth:session     optional      pam_sss.so