The quality policy screens out a weak password when it is set. But there is another danger: a password is not set but guessed — tried one after another until it matches. Check whether the system minds such guessing. Log in to the webadmin account with a deliberately wrong password several times in a row, and then with the correct one, and see whether anything changed after the run of misses.
Guess the password a few times
webadmin's password is ServiceAcct-7. Enter a wrong password four times in a row with su webadmin, then log in with the correct one.
First, predict
After four wrong attempts, will you log in with the correct password?
Now start the exercise, run the command and compare your prediction with the output.
Four wrong passwords in a row, and webadmin still let you in with the correct one. What does that mean?
-
Login lockout acts on the whole authentication stack,
suincluded: its PAM service readscommon-authtoo. -
Four misses is above any reasonable threshold, yet the account is open. So there is no counter in the stack:
faillock --user webadminis empty.
Nobody counts the misses — the login stack has no lockout.