#acupoftea - mail.ontime-ae.com

System	:	Linux server1.ontime-gulf.com 4.18.0-553.5.1.el8_10.x86_64 #1 SMP Wed Jun 5 09:12:13 EDT 2024 x86_64
Software	:	Apache
Server	:	162.0.230.206
Domains	:	40 Domain
Permission	:	[ drwxr-xr-x ]
	:	/ usr / share / doc / pam / txts /

216.73.216.38

Home

File README.pam_faillock

pam_faillock -- Module counting authentication failures during a specified
interval

--------------------------------------------------------------------------

DESCRIPTION

This module maintains a list of failed authentication attempts per user
   during a specified interval and locks the account in case there were more
   than deny consecutive failed authentications.

Normally, failed attempts to authenticate root will not cause the root
   account to become blocked, to prevent denial-of-service: if your users
   aren't given shell accounts and root may only login via su or at the
   machine console (not telnet/rsh, etc), this is safe.

OPTIONS

{preauth|authfail|authsucc}

This argument must be set accordingly to the position of this
           module instance in the PAM stack.

The preauth argument must be used when the module is called before
           the modules which ask for the user credentials such as the
           password. The module just examines whether the user should be
           blocked from accessing the service in case there were anomalous
           number of failed consecutive authentication attempts recently.
           This call is optional if authsucc is used.

The authfail argument must be used when the module is called after
           the modules which determine the authentication outcome, failed.
           Unless the user is already blocked due to previous authentication
           failures, the module will record the failure into the appropriate
           user tally file.

The authsucc argument must be used when the module is called after
           the modules which determine the authentication outcome, succeded.
           Unless the user is already blocked due to previous authentication
           failures, the module will then clear the record of the failures in
           the respective user tally file. Otherwise it will return
           authentication error. If this call is not done, the pam_faillock
           will not distinguish between consecutive and non-consecutive
           failed authentication attempts. The preauth call must be used in
           such case. Due to complications in the way the PAM stack can be
           configured it is also possible to call pam_faillock as an account
           module. In such configuration the module must be also called in
           the preauth stage.

The options for configuring the module behavior are described in the
   faillock.conf(5) manual page. The options specified on the module command
   line override the values from the configuration file.

NOTES

Configuring options on the module command line is not recommend. The
   /etc/security/faillock.conf should be used instead.

The setup of pam_faillock in the PAM stack is different from the
   pam_tally2 module setup.

Individual files with the failure records are created as owned by the
   user. This allows pam_faillock.so module to work correctly when it is
   called from a screensaver.

Note that using the module in preauth without the silent option specified
   in /etc/security/faillock.conf or with requisite control field leaks an
   information about existence or non-existence of an user account in the
   system because the failures are not recorded for the unknown users. The
   message about the user account being locked is never displayed for
   nonexisting user accounts allowing the adversary to infer that a
   particular account is not existing on a system.

EXAMPLES

Here are two possible configuration examples for /etc/pam.d/login. They
   make pam_faillock to lock the account after 4 consecutive failed logins
   during the default interval of 15 minutes. Root account will be locked as
   well. The accounts will be automatically unlocked after 20 minutes.

In the first example the module is called only in the auth phase and the
   module does not print any information about the account blocking by
   pam_faillock. The preauth call can be added to tell the user that his
   login is blocked by the module and also to abort the authentication
   without even asking for password in such case.

/etc/security/faillock.conf file example:

deny=4
 unlock_time=1200
 silent

/etc/pam.d/config file example:

auth     required       pam_securetty.so
 auth     required       pam_env.so
 auth     required       pam_nologin.so
 # optionally call: auth requisite pam_faillock.so preauth
 # to display the message about account being locked
 auth     [success=1 default=bad] pam_unix.so
 auth     [default=die]  pam_faillock.so authfail
 auth     sufficient     pam_faillock.so authsucc
 auth     required       pam_deny.so
 account  required       pam_unix.so
 password required       pam_unix.so shadow
 session  required       pam_selinux.so close
 session  required       pam_loginuid.so
 session  required       pam_unix.so
 session  required       pam_selinux.so open

In the second example the module is called both in the auth and account
   phases and the module gives the authenticating user message when the
   account is locked if silent option is not specified in the faillock.conf.

auth     required       pam_securetty.so
 auth     required       pam_env.so
 auth     required       pam_nologin.so
 auth     required       pam_faillock.so preauth
 # optionally use requisite above if you do not want to prompt for the password
 # on locked accounts
 auth     sufficient     pam_unix.so
 auth     [default=die]  pam_faillock.so authfail
 auth     required       pam_deny.so
 account  required       pam_faillock.so
 # if you drop the above call to pam_faillock.so the lock will be done also
 # on non-consecutive authentication failures
 account  required       pam_unix.so
 password required       pam_unix.so shadow
 session  required       pam_selinux.so close
 session  required       pam_loginuid.so
 session  required       pam_unix.so
 session  required       pam_selinux.so open

AUTHOR

pam_faillock was written by Tomas Mraz.

Name	Type	Size	Permission	Last Modified	Actions
.	DIR	-	drwxr-xr-x	2025-08-28 10:58:24
..	DIR	-	drwxr-xr-x	2025-08-28 10:58:24
README.pam_access	text/plain	5.13 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_chroot	text/plain	1.47 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_console	text/plain	1.88 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_cracklib	text/plain	9.53 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_debug	text/plain	1.95 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_deny	text/plain	1.01 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_echo	text/plain	1.07 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_env	text/plain	3.54 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_exec	text/plain	2.18 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_faildelay	text/plain	827 B	-rw-r--r--	2025-08-26 08:58:55
README.pam_faillock	text/plain	5.92 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_filter	text/plain	3.03 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_ftp	text/plain	1.66 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_group	text/plain	2.12 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_issue	text/plain	1.32 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_keyinit	text/plain	2.19 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_lastlog	text/plain	2.54 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_limits	text/plain	2.36 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_listfile	text/plain	3.54 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_localuser	text/plain	1.14 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_loginuid	text/plain	1.09 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_mail	text/plain	1.96 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_mkhomedir	text/plain	1.33 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_motd	text/plain	2.53 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_namespace	text/plain	11.27 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_nologin	text/plain	1.32 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_permit	text/plain	907 B	-rw-r--r--	2025-08-26 08:58:55
README.pam_postgresok	text/plain	346 B	-rw-r--r--	2025-08-26 08:58:55
README.pam_pwhistory	text/plain	2.19 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_rhosts	text/plain	1.84 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_rootok	text/plain	1.06 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_securetty	text/plain	1.31 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_selinux	text/plain	2.84 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_sepermit	text/plain	1.61 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_shells	text/plain	653 B	-rw-r--r--	2025-08-26 08:58:55
README.pam_stress	text/plain	2.01 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_succeed_if	text/plain	2.8 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_time	text/plain	1.27 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_timestamp	text/plain	1.58 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_tty_audit	text/plain	2.71 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_umask	text/plain	1.59 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_unix	text/plain	7.09 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_userdb	text/plain	2.9 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_usertype	text/plain	1.17 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_warn	text/plain	1.2 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_wheel	text/plain	1.92 KB	-rw-r--r--	2025-08-26 08:58:55
README.pam_xauth	text/plain	3.61 KB	-rw-r--r--	2025-08-26 08:58:55

~ ACUPOFTEA - mail.ontime-ae.com