security-misc/usr/share/pam-configs/tally2-security-misc

Name: lock accounts after 50 failed authentication attempts (by package security-misc)
Default: yes
Priority: 290
Auth-Type: Primary
Auth:
	optional	pam_exec.so	debug stdout seteuid /usr/lib/security-misc/pam_tally2-info
	[success=1 default=ignore]	pam_exec.so	seteuid quiet /usr/lib/security-misc/pam_tally2_not_if_x
	requisite	pam_tally2.so even_deny_root deny=50 onerr=fail audit debug
Account-Type: Primary
Account:
	requisite	pam_tally2.so debug
Lock user accounts after 50 rather than 100 failed login attempts. https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/19 2019-11-25 01:39:53 -05:00			`Name: lock accounts after 50 failed authentication attempts (by package security-misc)`
split usr/share/pam-configs/security-misc into usr/share/pam-configs/tally2-security-misc usr/share/pam-configs/wheel-security-misc 2019-08-01 07:04:22 -04:00			`Default: yes`
higher priority usr/share/pam-configs/tally2-security-misc so it can give info before pam stack gets aborted by other pam modules 2019-12-08 03:15:53 -05:00			`Priority: 290`
split usr/share/pam-configs/security-misc into usr/share/pam-configs/tally2-security-misc usr/share/pam-configs/wheel-security-misc 2019-08-01 07:04:22 -04:00			`Auth-Type: Primary`
			`Auth:`
informational output during PAM: * Show failed and remaining password attempts. * Document unlock procedure if Linux user account got locked. * Point out, that there is no password feedback for `su`. * Explain locked (root) account if locked. * /usr/share/pam-configs/tally2-security-misc * /usr/lib/security-misc/pam_tally2-info 2019-08-15 09:37:28 -04:00			`optional pam_exec.so debug stdout seteuid /usr/lib/security-misc/pam_tally2-info`
skip counting failed login attempts from dovecot Failed dovecot logins should not result in account getting locked. revert "use pam_tally2 only for login" 2021-01-27 05:49:34 -05:00			`[success=1 default=ignore] pam_exec.so seteuid quiet /usr/lib/security-misc/pam_tally2_not_if_x`
Lock user accounts after 50 rather than 100 failed login attempts. https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/19 2019-11-25 01:39:53 -05:00			`requisite pam_tally2.so even_deny_root deny=50 onerr=fail audit debug`
effectively (not directly) add "required pam_tally2.so debug" to /etc/pam.d/common-account This is required because otherwise something like "sudo bash" would count as a failed login for pam_tally2 even though it was successful. https://bugzilla.redhat.com/show_bug.cgi?id=707660 https://forums.whonix.org/t/restrict-root-access/7658 2019-08-10 06:06:39 -04:00			`Account-Type: Primary`
			`Account:`
use requisite rather than required to avoid asking for password needlessly if login will fail anyhow 2019-08-15 03:30:56 -04:00			`requisite pam_tally2.so debug`