AIX account Security Management

In system security reinforcement, we often need to set the number of failed logon attempts in WIN and UNIX. After the specified number of logon attempts is reached, the system disallows the user to log on. If it is a WIN platform, the account that is locked due to a failed login will be automatically unlocked after a period of time by the relevant parameter settings), and the AIX platform does not seem to be automatically unlocked, if it involves information collection, in this case, the user is very likely to be locked.
The following describes how to set logon times and lock users.
1. Set the unsuccessfulloginattempts Value
Method 1
Use Smittychuser to set the user1 attribute
NumberofFAILEDLOGINSbeforeuseraccountislocked is set to 3
Method 2
You can also use the command line to implement
# Chuserloginretries = 3user1
Check user attributes
# Lsuser-fuser1
User1:
Loginretries = 3

Pwdwarntime = 0
Account_locked = false
2. Try to log on with the wrong password
After logging on 3 times with the wrong password, the system prompts that the failed logon attempt has reached the limited threshold.
650) this. width = 650; "title =" image 1.png "alt =" 170200903.png" src = "http://www.bkjia.com/uploads/allimg/131228/000932FH-0.png"/>
3. Check the number of Logon failures

You can use lsuser to check the number of Logon failures.
# Lsuser-fuser1
User1:
Loginretries = 3
Pwdwarntime = 0
Account_locked = false
Host_last_login = 192.168.1.2
Host_last_unsuccessful_login = 192.168.1.2
Unsuccessful_login_count = 4

Alternatively, you can directly Browse/etc/security/lastlog and locate the row where user1 is located.

# Cat/etc/security/lastlog
User1:
Time _ last_login = 1262968379
Tty_last_login =/dev/pts/4
Host_last_login = 192.168.1.2
Unsuccessful_login_count = 4
4. Try to switch to user1 Through su-
Successful. It can be seen that even if the account is locked, su-can be used to switch to the locked account.
5. Failed Login Attempts account unlock
Method 1
Use SMITTYUSERS to unlock USER1
Select ResetUser 'sfailedlogincount and enter user1 In the username column.
Method 2
You can unlock a row by modifying the value of unsuccessful_login_count in etc/security/lastlog.
Vi/etc/security/lastlog, change unsuccessful_login_count = X to 0.
Logon successful

6. Manually lock/unlock users

Method 1: smituser-> lock/unlockauser 'saccount-> isthisuseraccountlocked? If it is set to true, it is locked. If it is set to false, it is unlocked.

Method 2,

The account_locked attribute of the user in the/etc/security/userr File

7. set other attributes

Smitchuser also has some other options, such

Numberofpasswordsbeforeresuser: number of repeated passwords

Weeksbeforepasswordreuser: number of weeks in which the password can be repeated

Passwordmaxiage: Password life, 0 is unlimited

Passwordminlength: Minimum Length

Hardfilesize: Hard Disk Quota

This article from the "Doodle growth Diary" blog, please be sure to keep this source http://3402313.blog.51cto.com/3392313/1300183