Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-23 19:41:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

Lock user accounts after 50 rather than 100 failed login attempts.

Browse Source 
https://forums.whonix.org/t/how-strong-do-linux-user-account-passwords-have-to-be-when-using-full-disk-encryption-fde-too/7698/19
This commit is contained in:
Patrick Schleizer 2019-11-25 01:39:53 -05:00
parent 6277db1383
commit aa5451c8cd
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
debian/control vendored
View File

@ -151,7 +151,7 @@ Description: enhances misc security settings
* Abort login for users with locked passwords. * Abort login for users with locked passwords.
/usr/lib/security-misc/pam-abort-on-locked-password /usr/lib/security-misc/pam-abort-on-locked-password
. .
* Lock user accounts after 100 failed login attempts using pam_tally2. * Lock user accounts after 50 failed login attempts using pam_tally2.
/usr/share/pam-configs/tally2-security-misc /usr/share/pam-configs/tally2-security-misc
. .
* Logging into the root account from a virtual, serial, whatnot console is * Logging into the root account from a virtual, serial, whatnot console is

2
usr/lib/security-misc/pam_tally2-info
View File

@ -54,7 +54,7 @@ fi
deny_line="$(cat /etc/pam.d/common-auth | grep deny=)" deny_line="$(cat /etc/pam.d/common-auth | grep deny=)"
## Example: ## Example:
#auth requisite pam_tally2.so even_deny_root deny=100 onerr=fail audit debug #auth requisite pam_tally2.so even_deny_root deny=50 onerr=fail audit debug
for word in $deny_line ; do for word in $deny_line ; do
if echo "$word" | grep -q "deny=" ; then if echo "$word" | grep -q "deny=" ; then

4
usr/share/pam-configs/tally2-security-misc
View File

@ -1,10 +1,10 @@
Name: lock accounts after 100 failed authentication attempts (by package security-misc) Name: lock accounts after 50 failed authentication attempts (by package security-misc)
Default: yes Default: yes
Priority: 260 Priority: 260
Auth-Type: Primary Auth-Type: Primary
Auth: Auth:
optional pam_exec.so debug stdout seteuid /usr/lib/security-misc/pam_tally2-info optional pam_exec.so debug stdout seteuid /usr/lib/security-misc/pam_tally2-info
requisite pam_tally2.so even_deny_root deny=100 onerr=fail audit debug requisite pam_tally2.so even_deny_root deny=50 onerr=fail audit debug
Account-Type: Primary Account-Type: Primary
Account: Account:
requisite pam_tally2.so debug requisite pam_tally2.so debug