linux红帽机器用户解锁,redhat – 在RHEL6中使用pam_tally2进行帐户锁定

我在每个策略登录3次失败后使用

pam_tally2来锁定帐户,但是,连接用户没有收到指示pam_tally2的操作的错误. (通过SSH.)

我希望在第4次尝试时看到：

Account locked due to 3 failed logins

没有必要或必需的组合或文件中的顺序似乎有帮助.这是在Red Hat 6下,我使用的是/etc/pam.d/password-auth.锁定确实按预期工作,但用户没有收到上述错误.这会引起很多混乱和挫折,因为当他们确定使用正确的密码时,他们无法知道身份验证失败的原因.

If locking out accounts after a number of incorrect login attempts is required by your security policy, implement use of pam_tally2.so.

To enforce password lockout, add the following to /etc/pam.d/system-auth. First, add to the top of the auth lines:

06001

Second, add to the top of the account lines:

06002

编辑：

我通过在其中一次登录尝试期间重置pam_tally2来获取错误消息.

user@localhost's password: (bad password)

Permission denied, please try again.

user@localhost's password: (bad password)

Permission denied, please try again.

(从另一个shell重置pam_tally2)

user@localhost's password: (good password)

Account locked due to ...

Account locked due to ...

Last login: ...

[user@localhost ~]$