Re: question about pam_tally and the faillog



----- Original Message -----
From: "Bill Tangren" <bjt@xxxxxxxxxxxxx>
To: "General Red Hat Linux discussion list" <redhat-list@xxxxxxxxxx>
Sent: Thursday, March 20, 2008 4:17 AM
Subject: Re: question about pam_tally and the faillog



I am running a number of RHEL ES 4.5 systems, fully updated.

The problem I am having is baffling me. I am using pam_tally so that
three
consecutive unsuccessful logins will lock out the user, until an hourly
cron script unlocks the account. It has worked fine for a number of
years.


Anyone?

I've noticed the same problem with other accounts. suing to root tallies
a
failed login, even though the su was successful.


Are you talking about remote SSH logins?

Are you using the UsePAM directive in your sshd_config file?



I am talking about suing to root or another user at the console. If you su
to any user successfully (except when root does it), it is recorded in the
faillog by pam_tally as a login failure.

--
Bill Tangren
U.S. Naval Observatory

Si hoc legere scis nimium eruditionis habes

--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list

Relevant Pages

  • Re: maxlogins
    ... Typically these resource limitations are used on server environments. ... I was hoping it'd limit subsequent failed logins... ... (limiting subsequent failed logins would be a very effective way to ... faillog - examine faillog and set login failure limits ...
    (Ubuntu)
  • Re: FreeBSD 4.3 RELEASE and -STABLE allows telnet root logins?
    ... FreeBSD 4.3 RELEASE and -STABLE allows telnet root logins? ... > UNIX is like the sights on a loaded gun. ...
    (FreeBSD-Security)
  • Re: su using SecurID cards
    ... use them for all logins to the system. ... anyone with a card to su to root. ... certain logins the ability to become root via rootsh, ... The "approved" fix is to create shadow accounts that have ID 0. ...
    (alt.os.linux.suse)
  • Re: su using SecurID cards
    ... use them for all logins to the system. ... anyone with a card to su to root. ... certain logins the ability to become root via rootsh, ... The "approved" fix is to create shadow accounts that have ID 0. ...
    (alt.os.linux.suse)
  • FW: FW: FW: Adding OpenBSD sudo to the FreeBSD base system?
    ... Yes, it gives you a huge advantage, assuming you disable direct root ... "> Regarding su vs. direct login, you should use su, it doesn't give ... And if you follow up by disabling direct root logins, ... The biggest advantage of sudo, though, is less security-related and more ...
    (FreeBSD-Security)