{"id":2678,"date":"2022-12-20T15:17:01","date_gmt":"2022-12-20T18:17:01","guid":{"rendered":"http:\/\/lode.uno\/linux-man\/index.php\/2022\/12\/20\/pam_faillock-man8\/"},"modified":"2022-12-20T15:17:01","modified_gmt":"2022-12-20T18:17:01","slug":"pam_faillock-man8","status":"publish","type":"post","link":"https:\/\/lode.uno\/linux-man\/2022\/12\/20\/pam_faillock-man8\/","title":{"rendered":"PAM_FAILLOCK (man8)"},"content":{"rendered":"

PAM_FAILLOCK<\/h1>\n

NAME<\/a>
SYNOPSIS<\/a>
DESCRIPTION<\/a>
OPTIONS<\/a>
MODULE TYPES PROVIDED<\/a>
RETURN VALUES<\/a>
NOTES<\/a>
EXAMPLES<\/a>
FILES<\/a>
SEE ALSO<\/a>
AUTHOR<\/a> <\/p>\n

\n

NAME <\/a> <\/h2>\n

pam_faillock \u2212 Module counting authentication failures during a specified interval<\/p>\n

SYNOPSIS <\/a> <\/h2>\n\n\n\n
<\/td>\n\n

auth … pam_faillock.so<\/b> {preauth|authfail|authsucc} [dir=\/path\/to\/tally\u2212directory<\/i>] [even_deny_root] [deny=n<\/i>] [fail_interval=n<\/i>] [unlock_time=n<\/i>] [root_unlock_time=n<\/i>] [admin_group=name<\/i>] [audit] [silent] [no_log_info]<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

account … pam_faillock.so<\/b> [dir=\/path\/to\/tally\u2212directory<\/i>] [no_log_info]<\/p>\n<\/td>\n<\/tr>\n<\/table>\n

DESCRIPTION <\/a> <\/h2>\n

This module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny<\/i> consecutive failed authentications.<\/p>\n

Normally, failed attempts to authenticate root<\/i> will not<\/b> cause the root account to become blocked, to prevent denial\u2212of\u2212service: if your users aren’t given shell accounts and root may only login via su<\/b> or at the machine console (not telnet\/rsh, etc), this is safe.<\/p>\n

OPTIONS <\/a> <\/h2>\n

{preauth|authfail|authsucc}<\/b><\/p>\n

This argument must be set accordingly to the position of this module instance in the PAM stack.<\/p>\n

The preauth<\/i> argument must be used when the module is called before the modules which ask for the user credentials such as the password. The module just examines whether the user should be blocked from accessing the service in case there were anomalous number of failed consecutive authentication attempts recently. This call is optional if authsucc<\/i> is used.<\/p>\n

The authfail<\/i> argument must be used when the module is called after the modules which determine the authentication outcome, failed. Unless the user is already blocked due to previous authentication failures, the module will record the failure into the appropriate user tally file.<\/p>\n

The authsucc<\/i> argument must be used when the module is called after the modules which determine the authentication outcome, succeded. Unless the user is already blocked due to previous authentication failures, the module will then clear the record of the failures in the respective user tally file. Otherwise it will return authentication error. If this call is not done, the pam_faillock will not distinguish between consecutive and non\u2212consecutive failed authentication attempts. The preauth<\/i> call must be used in such case. Due to complications in the way the PAM stack can be configured it is also possible to call pam_faillock<\/i> as an account module. In such configuration the module must be also called in the preauth<\/i> stage.<\/p>\n

The options for configuring the module behavior are described in the faillock.conf<\/b>(5) manual page. The options specified on the module command line override the values from the configuration file.<\/p>\n

MODULE TYPES PROVIDED <\/a> <\/h2>\n

The auth<\/b> and account<\/b> module types are provided.<\/p>\n

RETURN VALUES <\/a> <\/h2>\n

PAM_AUTH_ERR<\/p>\n

A invalid option was given, the module was not able to retrieve the user name, no valid counter file was found, or too many failed logins.<\/p>\n

PAM_SUCCESS<\/p>\n

Everything was successful.<\/p>\n

PAM_IGNORE<\/p>\n

User not present in passwd database.<\/p>\n

NOTES <\/a> <\/h2>\n

Configuring options on the module command line is not recommend. The \/etc\/security\/faillock.conf<\/i> should be used instead.<\/p>\n

The setup of pam_faillock<\/i> in the PAM stack is different from the pam_tally2<\/i> module setup.<\/p>\n

Individual files with the failure records are created as owned by the user. This allows pam_faillock.so<\/b> module to work correctly when it is called from a screensaver.<\/p>\n

Note that using the module in preauth<\/b> without the silent<\/b> option specified in \/etc\/security\/faillock.conf or with requisite<\/i> control field leaks an information about existence or non\u2212existence of an user account in the system because the failures are not recorded for the unknown users. The message about the user account being locked is never displayed for nonexisting user accounts allowing the adversary to infer that a particular account is not existing on a system.<\/p>\n

EXAMPLES <\/a> <\/h2>\n

Here are two possible configuration examples for \/etc\/pam.d\/login. They make pam_faillock<\/i> to lock the account after 4 consecutive failed logins during the default interval of 15 minutes. Root account will be locked as well. The accounts will be automatically unlocked after 20 minutes.<\/p>\n

In the first example the module is called only in the auth<\/i> phase and the module does not print any information about the account blocking by pam_faillock<\/i>. The preauth<\/i> call can be added to tell the user that his login is blocked by the module and also to abort the authentication without even asking for password in such case.<\/p>\n

\/etc\/security\/faillock.conf file example:<\/p>\n

deny=4
unlock_time=1200
silent<\/p>\n

\/etc\/pam.d\/config file example:<\/p>\n

auth required pam_securetty.so
auth required pam_env.so
auth required pam_nologin.so
# optionally call: auth requisite pam_faillock.so preauth
# to display the message about account being locked
auth [success=1 default=bad] pam_unix.so
auth [default=die] pam_faillock.so authfail
auth sufficient pam_faillock.so authsucc
auth required pam_deny.so
account required pam_unix.so
password required pam_unix.so shadow
session required pam_selinux.so close
session required pam_loginuid.so
session required pam_unix.so
session required pam_selinux.so open<\/p>\n

In the second example the module is called both in the auth<\/i> and account<\/i> phases and the module gives the authenticating user message when the account is locked if silent<\/b> option is not specified in the faillock.conf.<\/p>\n

auth required pam_securetty.so
auth required pam_env.so
auth required pam_nologin.so
auth required pam_faillock.so preauth
# optionally use requisite above if you do not want to prompt for the password
# on locked accounts
auth sufficient pam_unix.so
auth [default=die] pam_faillock.so authfail
auth required pam_deny.so
account required pam_faillock.so
# if you drop the above call to pam_faillock.so the lock will be done also
# on non\u2212consecutive authentication failures
account required pam_unix.so
password required pam_unix.so shadow
session required pam_selinux.so close
session required pam_loginuid.so
session required pam_unix.so
session required pam_selinux.so open<\/p>\n

FILES <\/a> <\/h2>\n

\/var\/run\/faillock\/*<\/p>\n

the files logging the authentication failures for users<\/p>\n

\/etc\/security\/faillock.conf<\/p>\n

the config file for pam_faillock options<\/p>\n

SEE ALSO <\/a> <\/h2>\n

faillock<\/b>(8), faillock.conf<\/b>(5), pam.conf<\/b>(5), pam.d<\/b>(5), pam<\/b>(8)<\/p>\n

AUTHOR <\/a> <\/h2>\n

pam_faillock was written by Tomas Mraz.<\/p>\n

\n","protected":false},"excerpt":{"rendered":"

pam_faillock \u2212 Module counting authentication failures during a specified interval <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[5,52,4,29],"class_list":["post-2678","post","type-post","status-publish","format-standard","hentry","category-8-administracion-del-sistema","tag-5","tag-administracion","tag-man8","tag-pam_faillock"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/2678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=2678"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/2678\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=2678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=2678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=2678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}