RHEL8中配置账户密码锁定策略

最新推荐文章于 2024-04-28 16:23:24 发布

土豆豆豆1

最新推荐文章于 2024-04-28 16:23:24 发布

阅读量2.6k

点赞数

分类专栏： Linux 8 文章标签： linux 服务器 centos

原文链接：https://access.redhat.com/solutions/62949

版权

Linux 8 专栏收录该内容

3 篇文章

订阅专栏

本文介绍了在RHEL8中如何使用pam_faillock模块来实现账户锁定策略，替代已过时的pam_tally。通过修改PAM配置文件，可以设置在多次登录失败后锁定用户账户，并在一定时间后自动解锁。此外，文章还提供了使用authconfig工具进行配置的方法，以及如何查看和重置失败尝试记录，以及调整sshd配置以确保功能正常。同时强调了PAM文件中配置顺序的重要性，并提到了在RHEL8中直接修改全局PAM文件的不推荐做法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

环境

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
PAM
pam_faillock.so

问题

What is pam_faillock ? How to implement account lockout policy using pam_faillock.so ?
pam_tally is deprecated in RHEL6, what can I configure instead of pam_tally ?
How do I reset/view failure attempts of user for pam_faillock ?
How can I use pam_faillock to disable a particular user(s) from getting locked out after multiple unsuccessful login attempts?
Since faillog command (pam_tally) is not available in RHEL 6, how do I use pam_faillock instead ?
pam_tally counter reset does not work correctly
What can I use instead of pam_tally2 since it is unavailable in RHEL 8?

决议

The pam_faillock module performs a function similar to pam_tally and pam_tally2 but with more options and flexibility. The following are some examples of how to include pam_faillock in /etc/pam.d/system-auth and /etc/pam.d/password-auth (changes should be made in both files to be effective):

To lock out users after three unsuccessful attempts and unlock the user account after 10 minutes (600 seconds):

Raw

auth        required      pam_env.so
auth        required      pam_faillock.so preauth silent audit deny=3 unlock_time=600      # Insert this line
auth        sufficient    pam_unix.so nullok try_first_pass
auth        [default=die] pam_faillock.so authfail audit deny=3 unlock_time=600             # Insert this line
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_faillock.so                                                                             # Insert this line
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

To lock out the root user, auth required pam_faillock.so should be added:

Raw

auth    required    pam_faillock.so preauth silent audit deny=3 even_deny_root unlock_time=1200 root_unlock_time=600

To disable a user from locking out even after multiple failed logins add the below line just above the pam_faillock in and replace user1, user2, etc with the actual usernames:

Raw
```
auth [success=1 default=ignore] pam_succeed_if.so user in user1:user2:user3
```

For more information of parameters in pam_faillock.so please use man pam_faillock to view the man page for pam_faillock.

Alternatively: Configure with authconfig

authconfig-6.2.8-19 and above supports pam_faillock.

To enable faillock:

Raw

# authconfig --enablefaillock --faillockargs="deny=5 unlock_timeout=1200" --update

To enable faillock:

Raw

# authconfig --disablefaillock --update

Using the `faillock` command

To reset/view authentication failure records use commands like the following:

To display authentication failure records for username:

Raw
```
# faillock --user username
```
To reset authentication failure records for username:

Raw
```
# faillock --user username --reset
```

SSHD configuration adjustment

If pam_faillock.so is not working as expected, the following changes may have to be made to SSHD's configuration:

Raw

# vi /etc/ssh/sshd_config
ChallengeResponseAuthentication yes
PasswordAuthentication no

Then restart the sshd service in order for these configuration changes to take effect:

Raw

# systemctl restart sshd

Additional Notes

The sequence of the lines in the files (/etc/pam.d/system-auth and /etc/pam.d/password-auth) are important and any change in sequence may result in the locking all user accounts including root user when you are using even_deny_root option.
The pam_faillock module supports temporary locking of user accounts in the event of multiple failed authentication attempts. This new module improves functionality over the existing pam_tally2 module, as it also allows temporary locking when the authentication attempts are done over a screensaver.
The pam_faillock module now also support persistent locking via errata release RHBA-2016-2314.
Additional information: Where is faillog command for Red Hat Enterprise Linux 6 ?
In RHEL8, we do not recommend you make modifications directly in PAM global files system-auth and password-auth available under /etc/pam.d/` directory.
To configure pam_faillock to lock ONLY local user accounts and skip network accounts such as IPA/AD/LDAP from being locked modify PAM files as mentioned in this article: How to setup account lockout policy using pam_faillock when system is an LDAP/IPA/AD client