Linux server and Windows Server user logon failures Limit "Internet financial system Vulnerability"

1, Linux Server user logon failure limit (implemented using PAM module)

/ETC/PAM.D/SSHD (remote SSH)

/etc/pam.d/login (terminal)

1.1. The limit of the number of users logged in via SSH

The first step is to use the PAM module to implement this function to check if there are pam_tally2.so files

# find/lib*-name pam_tally2.so
/lib64/security/pam_tally2.so

Second Step) Modify the configuration file:

# vi/etc/pam.d/sshd

#%pam-1.0
Auth required pam_tally2.so deny=3 unlock_time=300 even_deny_root root_unlock_time=300
Auth Required pam_sepermit.so
Auth include Password-auth
Account Required Pam_nologin.so
Account include Password-auth
Password include Password-auth
# pam_selinux.so Close should be the first session rule
Session Required Pam_selinux.so Close
Session Required Pam_loginuid.so
# pam_selinux.so Open should only is followed by sessions to being executed in the user context
Session Required pam_selinux.so Open Env_params
Session optional pam_keyinit.so Force revoke
Session include Password-auth

Save

Description: Deny=3 Set the consecutive login failed 3 times to start locking account, unlock_time=300 set lockout time is 300 seconds, that is, 5 minutes after unlocking; Even_deny_root indicates that the root user is also within limits; root_unlock_time= 300 indicates the time that root was unlocked for 300 seconds.

Note: This line must be written at the top, otherwise it will be overwritten by other policies.

1.2. Limit the number of local logon failures

# Vi/etc/pam.d/login
#%pam-1.0
Auth required pam_tally2.so deny=3 unlock_time=300
Auth [User_unknown=ignore success=ok ignore=ignore Default=bad] pam_securetty.so
Auth include System-auth
Account Required Pam_nologin.so
Account include System-auth
Password include System-auth
# pam_selinux.so Close should be the first session rule
Session Required Pam_selinux.so Close
Session Required Pam_loginuid.so
Session Optional Pam_console.so
# pam_selinux.so Open should only is followed by sessions to being executed in the user context
Session Required Pam_selinux.so Open
Session Required Pam_namespace.so
Session optional pam_keyinit.so Force revoke
Session include System-auth
-session Optional pam_ck_connector.so
Save

1.3. Check Login failed user and manual unlock command

View all Login failed users

# Pam_tally2--user
Login Failures Latest failure from
Shen 6 10/14/15 14:35:33 192.168.144.131

Manually unlock, reset the number of login failures for a user

# pam_tally2--user Shen--reset
Login Failures Latest failure from
Shen 6 10/14/15 14:35:33 192.168.144.1312. Windows Server user logon failure limit

Local security policies--account policies--Account lockout policy

Linux server and Windows Server user logon failures Limit "Internet financial system Vulnerability"