redhat – 在RHEL6中使用pam_tally2进行帐户锁定

我在每个策略登录3次失败后使用 pam_tally2来锁定帐户,但是,连接用户没有收到指示pam_tally2的操作的错误. (通过SSH.)

我希望在第4次尝试时看到：

Account locked due to 3 Failed logins

没有必要或必需的组合或文件中的顺序似乎有帮助.这是在Red Hat 6下,我使用的是/etc/pam.d/password-auth.锁定确实按预期工作,但用户没有收到上述错误.这会引起很多混乱和挫折,因为当他们确定使用正确的密码时,他们无法知道身份验证失败的原因.

实施遵循美国国家安全局的Guide to the Secure Conguration of Red Hat Enterprise Linux 5.(第45页)这是我的理解,那只有changed in PAM is that /etc/pam.d/sshd now includes /etc/pam.d/password-auth instead of system-auth.

If locking out accounts after a number of incorrect login attempts is required by your security policy,implement use of pam_tally2.so.

To enforce password lockout,add the following to /etc/pam.d/system-auth. First,add to the top of the auth lines:

06001

Second,add to the top of the account lines:

06002

编辑：

我通过在其中一次登录尝试期间重置pam_tally2来获取错误消息.

user@localhost's password: (bad password)
Permission denied,please try again.
user@localhost's password: (bad password)
Permission denied,please try again.

(从另一个shell重置pam_tally2)

user@localhost's password: (good password)
Account locked due to ...
Account locked due to ...
Last login: ...
[user@localhost ~]$

解决方法

您还需要/ etc / ssh / sshd_config中的ChallengeResponseAuthentication yes.

为了显示错误,pam需要一个会话功能.

此选项告诉ssh提供更完整的PAM会话功能,其中包括提供输出和请求任意输入(而不是仅通过sshd传递密码).

编辑：您需要PasswordAuthentication no以确保密码输入始终通过此PAM对话.

原文地址：https://www.jb51.cc/linux/399707.html