From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Steve M. Zak" Subject: auditing account lockouts Date: Mon, 10 Oct 2011 09:54:00 -0400 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8553976333929187748==" Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id p9ADqieS016150 for ; Mon, 10 Oct 2011 09:52:44 -0400 Received: from email.faac.com (email.faac.com [96.61.198.2]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p9ADqdLO011656 for ; Mon, 10 Oct 2011 09:52:39 -0400 Received: from hailstorm.faac.com ([10.10.10.30]:44088) by email.faac.com with esmtps (TLSv1:RC4-MD5:128) (Exim 4.69) (envelope-from ) id 1RDGHU-0000oM-1b for Linux-audit@redhat.com; Mon, 10 Oct 2011 09:52:36 -0400 Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============8553976333929187748== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_E2B97F4E65AFD84DA1A7B3BEC35E17140149E9350822hailstormfa_" --_000_E2B97F4E65AFD84DA1A7B3BEC35E17140149E9350822hailstormfa_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, Through experimentation and per Red Hat tech support when the deny=3Dx swit= ch is set in /etc/pam.d/login as below auth required pam_tally2.so deny=3D5 onerr=3Dfail the lockout happens at 5 failed attempts, but the audit trail does not reco= rd it until the next try. Does the audit system provide a way to show that the lockout has occurred w= hen the deny number is reached? Ideally this would be some system log that= uses a variation of "Account locked" Thanks! ____________________________________________ Steve M. Zak, --=20 This email was Anti Virus checked by Astaro Security Gateway. http://www.as= taro.com --_000_E2B97F4E65AFD84DA1A7B3BEC35E17140149E9350822hailstormfa_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Hi,

 

Through ex= perimentation and per Red Hat tech support when the deny=3Dx switch is set = in /etc/pam.d/login as below

 =

auth       req= uired     pam_tally2.so deny=3D5 onerr=3Dfail

 

the loc= kout happens at 5 failed attempts, but the audit trail does not record it u= ntil the next try.

 

=

Does the audit system provide a way to show that the l= ockout has occurred when the deny number is reached?  Ideally this wou= ld be some system log that uses a variation of “Account locked”=

 

 

 

Thanks!

 

____________________________________________

Steve M. Zak,

 

--=20
This email was Anti Virus checked by Astaro Security Gateway. http://www.as=
taro.com
--_000_E2B97F4E65AFD84DA1A7B3BEC35E17140149E9350822hailstormfa_-- --===============8553976333929187748== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============8553976333929187748==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: auditing account lockouts Date: Mon, 10 Oct 2011 10:13:05 -0400 Message-ID: <201110101013.06113.sgrubb@redhat.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, October 10, 2011 09:54:00 AM Steve M. Zak wrote: > Hi, > > Through experimentation and per Red Hat tech support when the deny=x switch > is set in /etc/pam.d/login as below > > auth required pam_tally2.so deny=5 onerr=fail > > the lockout happens at 5 failed attempts, but the audit trail does not > record it until the next try. The man page says that the account lockout occurs when the tally _exceeds_ the deny parameter. To lockout on 5 failed attempts, use deny=4. -Steve