I am using AIx 4.3.3 and was wondering what the command was to keep users from logging in. I want to be able to do maintenance and keep the users out. Can anyone help? (7 Replies)
Hi, I am extremely new to UNIX and was recently promoted to administer the system for a small company. Anyhow, the time came for passwords to change, and I made the huge mistake of entering in the command (as root)
passwd -l
After logging out (oblivious to what would happen next), the root... (4 Replies)
Hi,
We are using 4.3.3.0 and I would like to make a global change to the "number of failed logins before user account is locked"
Any ideas, other than using SMIT one user at a time.... ???
Thanks... Craig. (2 Replies)
I want to know if there is any easy way of stopping 1 user from using su? perferabily any su but I can make do with not allow him to su to root but allow other user to su to root. (3 Replies)
Hi all;
I m using Red Hat Enterprise Linux Server release 5.1 (Tikanga) and I'm trying to setup password lockout policy so that a user account locks out after 3 failed attempts.
Here are the entires of my /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes... (1 Reply)
What is the best way to implement account lockout in openldap? I have an openldap server with Ubuntu desktop client connecting to it for authentication. I want he accounts to locked out after say 5 failed authentication attempts
I have enabled ppolicy layout in slapd.conf.
overlay ppolicy... (0 Replies)
having account lockout issues with an RHEL 5 server. My users are getting locked out for 10 minutes after one failed login attempt even though /etc/pam.d/sshd is configured for 5 failed attempts:
auth include system-auth
auth required pam_tally2.so deny=5 onerr=fail... (1 Reply)
Greetings,
I work with a Solaris Sun Server V240 system (GCCS) and have run into a problem where I can't seem to unlock my SECMAN account at the NON-GLOBAL level. I have access to all global accounts to include sysadmin and secman. I have access to the non-global sysadmin account and root... (4 Replies)
Good day. I have setup hardening the password (test system so far) prior to doing any work on production. Here is what I have set.
Snippet from /etc/pam.d/system-auth
auth required /lib/security/$ISA/pam_env.so
auth required /lib/security/$ISA/pam_tally.so... (3 Replies)
Discussion started by: smurphy_it
3 Replies
LEARN ABOUT REDHAT
faillog
FAILLOG(8) System Manager's Manual FAILLOG(8)NAME
faillog - examine faillog and set login failure limits
SYNOPSIS
faillog [-u login-name] [-a] [-t days]
[-m max] [-pr]
DESCRIPTION
faillog formats the contents of the failure log, /var/log/faillog, and maintains failure counts and limits. The order of the arguments to
faillog is significant. Each argument is processed immediately in the order given.
The -p flag causes failure entries to be printed in UID order. Entering -u login-name flag will cause the failure record for login-name
only to be printed. Entering -t days will cause only the failures more recent than days to be printed. The -t flag overrides the use of
-u. The -a flag causes all users to be selected. When used with the -p flag, this option selects all users who have ever had a login
failure. It is meaningless with the -r flag.
The -r flag is used to reset the count of login failures. Write access to /var/log/faillog is required for this option. Entering -u
login-name will cause only the failure count for login-name to be reset.
The -m flag is used to set the maximum number of login failures before the account is disabled. Write access to /var/log/faillog is
required for this option. Entering -m max will cause all accounts to be disabled after max failed logins occur. This may be modified with
-u login-name to limit this function to login-name only. Selecting a max value of 0 has the effect of not placing a limit on the number of
failed logins. The maximum failure count should always be 0 for root to prevent a denial of services attack against the system.
Options may be combined in virtually any fashion. Each -p, -r, and -m option will cause immediate execution using any -u or -t modifier.
CAVEATS
faillog only prints out users with no successful login since the last failure. To print out a user who has had a successful login since
their last failure, you must explicitly request the user with the -u flag, or print out all users with the -a flag.
Some systems may replace /var/log with /var/adm or /usr/adm.
FILES
/var/log/faillog - failure logging file
SEE ALSO login(1), faillog(5)AUTHOR
Julianne Frances Haugh (jockgrrl@ix.netcom.com)
FAILLOG(8)