Linux: Implementation of account lock policies

Setting a lock policy for an account is a requirement in the security baseline configuration. in windows, you can easily set a lock policy. in linux, you can use the pam_tally2.so module of pam. Linux's account locking function is more extensive and powerful than windows's. in windows Group Policy...

Setting a lock policy for an account is a requirement in the security baseline configuration. in windows, you can easily set a lock policy. in linux, you can use the pam_tally2.so module of pam.
Linux has more extensive and powerful account locking functions than windows. windows group policies only impose system-level restrictions, while linux uses pam (Pluggable Authentication Modules, plug-In Authentication Module), not only can be implemented at the system level, but also can be implemented in various applications that support pam.
Understand the pam_tally2 module: [root @ localhost ~] # Man pam_tally2.so PAM_TALLY2 (8) Linux-PAM Manual PAM_TALLY2 (8)
NAME pam_tally2-The login counter (tallying) module SYNOPSIS pam_tally2.so [file =/path/to/counter] [onerr = [fail | succeed] [magic_root] [even_deny_root] [deny = n] [lock_time = n] [un_time = n] [root_unlock_time = n] [serialize] [audit] [silent] [no_log_info] pam_tally2 [-- file/path/to/counter] [-- user username] [-- reset [= n] [-- quiet] DESCRIPTION This module maintains a count of attempted accesses, Can reset count on success, can deny access if too implements attempts fail. pam_tally2 comes in two parts: pam_tally2.so and pam_tally2. the former is the PAM module and the latter, a stand-alone program. pam_tally2 is an (optional) application which can be used to interrogate and manipulate the counter file. it can display user's counts, set individual counts, or clear all counts. setting artificially High counts may be useful for blocking users without changing their passwords. for example, one might find it useful to clear all counts every midnight from a cron job. normally, failed attempts to access root will not cause the root account to become blocked, to prevent denial-of-service: if your users aren't given shell accounts and root may only login via su or at the machine console (not teln Et/rsh, etc), this is safe. the pam_tally.so/pam_tally2.so module will configure a logon failure counter for the user. each logon failure will add 1 to the counter and lock the account for a period of time after the threshold value is reached. because pam_tally.so is an old version, the account can only be permanently locked once the number of failed logins exceeds the threshold until the root user unlocks the user. the unlock_time parameter is added to pam_tally2.so to enable automatic unlocking.
Pam_tally2 consists of the pam_tally2.so pam module and the pam_tally2 program. pam_tally2 is used to view and adjust the counter. if you unlock the user manually, the counter is reset. The root user is not restricted unless the even_root_deny parameter is added to the configuration file. The counter is reset to zero after the user successfully logs on.
Pam_tally2.so main parameter: deny = n: locked when logon fails for n times.
Lock_time = n: the time when the user enters the wrong password. unlock_time = n: the unlock time. after the user is locked, the last attempt to unlock even_deny_root takes n seconds: root is also restricted by root_unlock_time = n: this parameter can be used to set the unlock time for root. If this parameter is not set, the value of unlock_time will be used.
File =/path/to/counter: specifies the location of the counter file. the default value is/var/log/tallylog.
Instance operation: increases the difficulty of brute-force password cracking and sets an account lock policy. Password cracking in linux is concentrated on sshd. This article uses the openssh service as an instance to configure an account lock policy.
The policy requirements are as follows: 1. set the lock threshold to 5 times. 2. the lock time is 5 minutes, that is, 300 seconds. all users must be restricted, including modifying the pam configuration file of openssh by root and adding the red configuration.
Vim/etc/pam. d/sshd # % PAM-1.0 auth required pam_tally2.so even_deny_root deny = 5 unlock_time = 300 auth required pam_sepermit.so auth include password-auth ...... ...... ......
Use root for remote ssh login, enter the wrong password five times, and enter pam_tally2 [root @ localhost ~] on the logged-on machine # Pam_tally2 Login Failures Latest failure From root 5 09/18/11 02:49:51 192.168.1.3 tom 5 09/18/11 02:50:00 192.168.1.3 sixth Login. the correct password is used, and ssh still prompts that the username and password are incorrect, wait five minutes before the logon succeeds. enter pam_tally2 [root @ localhost ~] on the logged-on machine again. # Pam_tally2 Login Failures Latest failure From root 5 09/18/11 02:50:00 192.168.1.3 after the root logon is successful, the counter is reset.
You can also run the command pam_tally2-u tom -- reset to reset the user's counter.
Summary: modify the pam configuration of sshd to restrict only ssh-based logon. if you write the restriction in the longin configuration, the restriction will be wider. telnet, rhost, and local logon will be limited.
In other words, you cannot set a reset time for the counter. as long as the user has not successfully logged on, the counter will not be automatically reset to zero. Finally, it is not the best way to prevent brute-force cracking by locking the account. in the case of brute-force cracking, all users may be locked, affecting the normal use of the system, the best way is to restrict the logon source.