Re: Account Lockouts

Steve Grubb
2009-01-07T15:25:27Z

On Wednesday 07 January 2009 10:17:54 am Starr-Renee Corbin wrote:
> While the account lockout policy is set, I am unable to figure out the
> syntax for the watches to add to audit.rules that will show the account
> lockout event. I have to be able to do this for about 150 systems.

pam_tally2 is hardwired to send lockout events to the audit system. Use it
rather than pam_tally. They will be in the audit logs as ANOM_LOGIN_FAILURES
when the limit is reached, as RESP_ACCT_LOCK_TIMED for the actual locking of
the acct, and RESP_ACCT_UNLOCK_TIMED when the acct is unlocked due to time
expiration or admin action.

-Steve