RHEL8中配置账户密码锁定策略_redhat8 账户锁定策略

环境

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• PAM
• pam_faillock.so

问题

• What is pam_faillock ? How to implement account lockout policy using pam_faillock.so ?
• pam_tally is deprecated in RHEL6, what can I configure instead of pam_tally ?
• How do I reset/view failure attempts of user for pam_faillock ?
• How can I use pam_faillock to disable a particular user(s) from getting locked out after multiple unsuccessful login attempts?
• Since faillog command (pam_tally) is not available in RHEL 6, how do I use pam_faillock instead ?
• pam_tally counter reset does not work correctly
• What can I use instead of pam_tally2 since it is unavailable in RHEL 8?

决议

The pam_faillock module performs a function similar to pam_tally and pam_tally2 but with more options and flexibility. The following are some examples of how to include pam_faillock in /etc/pam.d/system-auth and /etc/pam.d/password-auth (changes should be made in both files to be effective):

• To lock out users after three unsuccessful attempts and unlock the user account after 10 minutes (600 seconds):

  Raw

  auth        required      pam_env.so
  auth        required      pam_faillock.so preauth silent audit deny=3 unlock_time=600      # Insert this line
  auth        sufficient    pam_unix.so nullok try_first_pass
  auth        [default=die] pam_faillock.so authfail audit deny=3 unlock_time=600             # Insert this line
  auth        requisite     pam_succeed_if.so uid >= 500 quiet
  auth        required      pam_deny.so
   
  account     required      pam_faillock.so                                                                             # Insert this line
  account     required      pam_unix.so
  account     sufficient    pam_localuser.so
  account     sufficient    pam_succeed_if.so uid < 500 quiet
  account     required      pam_permit.so
  

• To lock out the root user, auth required pam_faillock.so should be added:

  Raw

  auth    required    pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=1200 root_unlock_time=600
  

• To disable a user from locking out even after multiple failed logins add the below line just above the pam_faillock in and replace user1, user2, etc with the actual usernames:

  Raw

  auth [success=1 default=ignore] pam_succeed_if.so user in user1:user2:user3
  

For more information of parameters in pam_faillock.so please use man pam_faillock to view the man page for pam_faillock.

Alternatively: Configure with authconfig

authconfig-6.2.8-19 and above supports pam_faillock.

• To enable faillock:

  Raw

  # authconfig --enablefaillock --faillockargs="deny=5 unlock_timeout=1200" --update
  

• To enable faillock:

  Raw

  # authconfig --disablefaillock --update
  

Using the faillock command

To reset/view authentication failure records use commands like the following:

• To display authentication failure records for username:

  Raw

  # faillock --user username
  

• To reset authentication failure records for username:

  Raw

  # faillock --user username --reset
  

SSHD configuration adjustment

If pam_faillock.so is not working as expected, the following changes may have to be made to SSHD's configuration:

Raw

# vi /etc/ssh/sshd_config
ChallengeResponseAuthentication yes
PasswordAuthentication no

Then restart the sshd service in order for these configuration changes to take effect:

Raw

# systemctl restart sshd

Additional Notes

• The sequence of the lines in the files (/etc/pam.d/system-auth and /etc/pam.d/password-auth) are important and any change in sequence may result in the locking all user accounts including root user when you are using even_deny_root option.

• The pam_faillock module supports temporary locking of user accounts in the event of multiple failed authentication attempts. This new module improves functionality over the existing pam_tally2 module, as it also allows temporary locking when the authentication attempts are done over a screensaver.

• The pam_faillock module now also support persistent locking via errata release RHBA-2016-2314.

• Additional information: Where is faillog command for Red Hat Enterprise Linux 6 ?

• In RHEL8, we do not recommend you make modifications directly in PAM global files system-auth and password-auth available under /etc/pam.d/` directory.

• To configure pam_faillock to lock ONLY local user accounts and skip network accounts such as IPA/AD/LDAP from being locked modify PAM files as mentioned in this article: How to setup account lockout policy using pam_faillock when system is an LDAP/IPA/AD client