Re: what is "faillog" all about?

[Werner Puschitz <w us verizon net>]

See pam_tally.

Here is an example how I configured RH6.2 so that 3 failed logins will
lock the account via pam_tally:

/etc/pam.d/login:
auth       required     /lib/security/pam_securetty.so
auth       required     /lib/security/pam_pwdb.so shadow nullok
auth       required     /lib/security/pam_tally.so onerr=fail no_magic_root
auth       required     /lib/security/pam_nologin.so
account    required     /lib/security/pam_pwdb.so
account    required     /lib/security/pam_access.so
account    required     /lib/security/pam_tally.so deny=3 no_magic_root reset
password   required     /lib/security/pam_cracklib.so
password   required     /lib/security/pam_pwdb.so nullok use_authtok md5 shadow
session    required     /lib/security/pam_pwdb.so
session    optional     /lib/security/pam_console.so


Then make sure to create the file /var/log/faillog with permissions 600.

Now when an account gets locked because of too many failed logins, you
can unlock the account by executing 'faillog -r <user_name>'.

Werner



On Sat, 31 Mar 2001, rpjday wrote:

>
>   i was perusing the contents of the shadow-utils RPM, and
> came across the "faillog" program.  there's a program and
> a man page, but there is no log file /var/log/faillog and it's
> not at all obvious how to activate logging.  i've deliberately
> logged in incorrectly but ... nothing.
>
>   this looks like a useful feature.  does it actually work?
>
> rday
>
>