Comments on: Linux Failed Login Control: Lock and Unlock User Accounts Using PAM

By: Yongzhi Pan

Yongzhi Pan — Sun, 08 Jan 2012 06:23:49 +0000

“Append following AUTH configuration to /etc/pam.d/system-auth file”

This does not work. I have tested it. Even if the fails are recorded, login is not denied at all. The modules are tried in the order list. You have to prepend it before any ‘auth’ to use it.

Another note, we should be using the newer pam_tally2.so module.

By: Yongzhi Pan

Yongzhi Pan — Sun, 08 Jan 2012 05:39:56 +0000

Aaron C, Just edit this file and do not use authconfig.

It should be noted this will not effect for ssh remote login. You should put it in `sshd’ pam config file for this.

By: Aaron C

Aaron C — Thu, 08 Dec 2011 20:59:31 +0000

From the top of /etc/pam.d/system-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

Is there another place these options should be set so that authconfig does not clobber them? Right now, as a work around, I am going to `chattr +i /etc/pam.d/system-auth`.

Thanks,
Aaron