07-17-2017
Solaris Automatic Account Unlock
Hello,
It is to my understanding that when configuring the Solaris operating system to meet compliance standards, you must configure the "LOCK_AFTER_RETRIES" value in the "/etc/security/policy.conf" file to "YES", and then configure the "RETRIES" parameter in the "/etc/default/login" file to the number of retries you wish to allow users before they are locked out.
However, is there any way to configure the OS so that user accounts are automatically unlocked after a specified period of time? I have tried setting the "DISABLETIME" parameter in the "/etc/default/login" file to 900 seconds (15 minutes) to configure this, but accounts I have locked out remain locked out, even after 15 minutes. Is this perhaps configurable from the PAM module? Or will the system always require manual intervention from an administrator using the "passwd" command to unlock accounts that have been locked out?
Thank you!
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hi,
I am currently working in a security project and I was wondering wether you can help me out. I need to find a way to secure scripts and files in Solaris 10 so they do not contain embedded clear text passwords.
The following is an example of a command that could be issued to determine if... (1 Reply)
Discussion started by: nircob
1 Replies
2. Solaris
I only able to lock user ID with passwd -l username
It seems there is no option for me to unlock ID in solaris?
Is there any command as below?
passwd -u username
Appreciate someome can share with me the way to do it. (1 Reply)
Discussion started by: dwarf007
1 Replies
3. UNIX for Dummies Questions & Answers
Hi I am working in Solaris 10 and I want to monitor logs for every telnet/ssh session that tries to connect to the server. I need these logs to be generated in a file that I can fetch using ftp.
I am a new user and a stepwise detail will be great
BR
saGGee (3 Replies)
Discussion started by: saggee
3 Replies
4. UNIX for Advanced & Expert Users
Hi,
I need to deactivate a user account for some time and then reactivate the user account ...
Can anybody please help me how to do this.....
I don't have root privileges but i have sudo to privileges.
Thanks....
Thread closed. Double post. Continued here. (0 Replies)
Discussion started by: firestar
0 Replies
5. Solaris
Hi,
I need to deactivate a user account for some time and then reactivate the user account ...
Can anybody please help me how to do this.....
I don't have root privileges but i have sudo to privileges.
Thanks.... (3 Replies)
Discussion started by: firestar
3 Replies
6. Solaris
Hi
I need to create a new user account in salaries. Can anyone tell me the cmd to create the new user acc. But the main thing is it should same permissions ,same group etc of already existing group.
For example we have already one user in name “comp” so the newly created user should also have... (3 Replies)
Discussion started by: kkalyan
3 Replies
7. Solaris
Is there an automatic method for adding drivers to Solaris 10? I know there is add_drv, (0 Replies)
Discussion started by: trinityforce
0 Replies
8. UNIX for Advanced & Expert Users
Hi - Please help me to understand the Veritas Cluster fail-over capability.
We configured oracle database file system on veritas cluster file system and it is automatically failing-over from node 1 to node 2.
Does Veritas cluster softward have any option to fail-back from node 2 to node 1... (6 Replies)
Discussion started by: Mansoor8810
6 Replies
9. Shell Programming and Scripting
Dear Experts ,
I want to stop and Start tomcat at the time of shutdown and startup of our server . I was trying to stop tomcat with following command
# su - dm -c "/export/home/Finder/FinderWeb/jakarta-tomcat-3.3.1a/bin/shutdown.sh"
but i am getting following error. Please suggest .... (1 Reply)
Discussion started by: Amit.saini333
1 Replies
10. Red Hat
Hi
We have these specific requirements for a bunch of servers we have and cannot seem to get pam to behave in this way. We would like:
PAM locks accounts if pam tally reaches 10.
PAM unlocks the account after 30mins from locking it, and resets the pam_tally.
The key is that we don't... (0 Replies)
Discussion started by: snoop2048
0 Replies
LEARN ABOUT X11R4
pam_unix_auth
pam_unix_auth(5) Standards, Environments, and Macros pam_unix_auth(5)
NAME
pam_unix_auth - PAM authentication module for UNIX
SYNOPSIS
pam_unix_auth.so.1
DESCRIPTION
The pam_unix_auth module implements pam_sm_authenticate(), which provides functionality to the PAM authentication stack. It provides func-
tions to verify that the password contained in the PAM item PAM_AUTHTOK is the correct password for the user specified in the item
PAM_USER. If PAM_REPOSITORY is specified, then user's passwd is fetched from that repository. Otherwise, the default nsswitch.conf(4)
repository is searched for that user. For accounts in the name services which support automatic account locking, the account may be config-
ured to be automatically locked (see user_attr(4) and policy.conf(4)) after multiple failed login attempts. If the number of successive
failures equals or exceeds RETRIES, the account is locked and PAM_MAXTRIES is returned. Currently, only the "files" repository (see
passwd(4) and shadow(4)) supports automatic account locking. A successful authentication by this module clears the failed login counter and
reports the number of failed attempts since the last successful authentication.
Authentication service modules must implement both pam_sm_authenticate() and pam_sm_setcred(). To allow replacability of the authentication
portion of UNIX authentication, pam_sm_setcred() in this module always returns PAM_IGNORE. This module should be stacked with
pam_unix_cred(5) to ensure a successful return from pam_setcred(3PAM).
The following options can be passed to the module:
nowarn Turn off warning messages.
server_policy If the account authority for the user, as specified by PAM_USER, is a server, do not apply the Unix policy from the passwd
entry in the name service switch.
nolock Regardless of the automatic account locking setting for the account, do not lock the account, increment or clear the failed
login count. The nolock option allows for exempting account locking on a per service basis.
ERRORS
The following error codes are returned from pam_sm_authenticate():
PAM_AUTH_ERR
Authentication failure.
PAM_BUF_ERR
Memory buffer error.
PAM_IGNORE
Ignores module, not participating in result.
PAM_MAXTRIES
Maximum number of retries exceeded.
PAM_PERM_DENIED
Permission denied.
PAM_SUCCESS
Successfully obtains authentication token.
PAM_SYSTEM_ERR
System error.
PAM_USER_UNKNOWN
No account present for user.
The following error codes are returned from pam_sm_setcred():
PAM_IGNORE
Ignores this module regardless of the control flag.
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Interface Stability |Evolving |
+-----------------------------+-----------------------------+
|MT Level |MT-Safe with exceptions |
+-----------------------------+-----------------------------+
SEE ALSO
login(1), passwd(1), useradd(1M), usermod(1M), roleadd(1M), rolemod(1M), libpam(3LIB), pam(3PAM), pam_authenticate(3PAM), pam_set-
cred(3PAM), syslog(3C), pam.conf(4), passwd(4), policy.conf(4), nsswitch.conf(4), shadow(4), user_attr(4), attributes(5), pam_auth-
tok_check(5), pam_authtok_get(5), pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_session(5)
NOTES
The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.
The pam_unix(5) module is no longer supported. Similar functionality is provided by pam_authtok_check(5), pam_authtok_get(5), pam_auth-
tok_store(5), pam_dhkeys(5), pam_passwd_auth(5),pam_setcred(3PAM), pam_unix_account(5), pam_unix_cred(5), pam_unix_session(5).
If the PAM_REPOSITORY item_type is set and a service module does not recognize the type, the service module does not process any informa-
tion, and returns PAM_IGNORE. If the PAM_REPOSITORY item_type is not set, a service module performs its default action.
SunOS 5.10 2 Aug 2004 pam_unix_auth(5)