So that password guessing cannot go on forever, a miss counter — faillock — is added to the login stack.
The pam_faillock module counts failed login attempts for each account and locks it when there are too many. The image does not have it in the stack, so misses lead to nothing. You wire it in with two lines in common-auth: preauth before pam_unix — to check whether the account is already locked; authfail after — to count a miss. faillock has no ready-made setting for pam-auth-update: the lines are written by hand, with a copy of the file kept. The threshold and the timeout go in /etc/security/faillock.conf: deny — how many misses before a lock, unlock_time — after how many seconds the lock opens on its own.
A locked account is shown by faillock --user <name> — a list of misses. The lock is cleared early by faillock --user <name> --reset. Misses are counted per the account being logged into, whoever logs in; root is not touched by the lockout, so a locked account can always be unlocked.
Set up the lockout so that webadmin is locked after three misses, and verify it by action.
Lock the account after misses
Set up a lockout: after three wrong attempts the account must stop letting anyone in, even with the correct password, until it is unlocked. Check it on webadmin.
Goals · 0 of 2
- Wire miss-counting into the login stack not done yet
- Lock the account after three misses not done yet