mirror of
https://github.com/Kicksecure/security-misc.git
synced 2024-12-27 13:09:26 -05:00
63 lines
2.2 KiB
Plaintext
63 lines
2.2 KiB
Plaintext
# Configuration for locking the user after multiple failed
|
|
# authentication attempts.
|
|
#
|
|
# The directory where the user files with the failure records are kept.
|
|
# The default is /var/run/faillock.
|
|
# dir = /var/run/faillock
|
|
#
|
|
# Will log the user name into the system log if the user is not found.
|
|
# Enabled if option is present.
|
|
audit
|
|
#
|
|
# Don't print informative messages.
|
|
# Enabled if option is present.
|
|
# silent
|
|
#
|
|
# Don't log informative messages via syslog.
|
|
# Enabled if option is present.
|
|
# no_log_info
|
|
#
|
|
# Only track failed user authentications attempts for local users
|
|
# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
|
|
# The `faillock` command will also no longer track user failed
|
|
# authentication attempts. Enabling this option will prevent a
|
|
# double-lockout scenario where a user is locked out locally and
|
|
# in the centralized mechanism.
|
|
# Enabled if option is present.
|
|
# local_users_only
|
|
#
|
|
# Deny access if the number of consecutive authentication failures
|
|
# for this user during the recent interval exceeds n tries.
|
|
# The default is 3.
|
|
deny = 50
|
|
#
|
|
# The length of the interval during which the consecutive
|
|
# authentication failures must happen for the user account
|
|
# lock out is <replaceable>n</replaceable> seconds.
|
|
# The default is 900 (15 minutes).
|
|
# fail_interval = 900
|
|
#
|
|
# The access will be re-enabled after n seconds after the lock out.
|
|
# The value 0 has the same meaning as value `never` - the access
|
|
# will not be re-enabled without resetting the faillock
|
|
# entries by the `faillock` command.
|
|
# The default is 600 (10 minutes).
|
|
# unlock_time = 600
|
|
#
|
|
# Root account can become locked as well as regular accounts.
|
|
# Enabled if option is present.
|
|
even_deny_root
|
|
#
|
|
# This option implies the `even_deny_root` option.
|
|
# Allow access after n seconds to root account after the
|
|
# account is locked. In case the option is not specified
|
|
# the value is the same as of the `unlock_time` option.
|
|
# root_unlock_time = 900
|
|
#
|
|
# If a group name is specified with this option, members
|
|
# of the group will be handled by this module the same as
|
|
# the root account (the options `even_deny_root>` and
|
|
# `root_unlock_time` will apply to them.
|
|
# By default, the option is not set.
|
|
# admin_group = <admin_group_name>
|