导言
Removed deprecated pam_tally and pam_tally2 modules, use pam_faillock instead.
- pam_tally2配置
sed -i '1s/^/auth required pam_tally2.so onerr=fail deny=5 unlock_time=600 even_deny_root root_unlock_time=60/' /etc/pam.d/login
sed -i '1 i auth required pam_tally2.so onerr=fail deny=5 unlock_time=600 even_deny_root root_unlock_time=60' /etc/pam.d/sshd
建立存储目录
mkdir /var/log/faillock
faillock相关的信息会以用存储在这个目录下
配置
- 远程登录文件
/etc/pam.d/sshd
auth requisite pam_faillock.so preauth
auth [success=1 default=bad] pam_unix.so shadow nullok
auth [default=die] pam_faillock.so authfail
auth sufficient pam_faillock.so authsucc
account required pam_unix.so shadow nullok
password required pam_unix.so shadow nullok
session required pam_unix.so shadow nullok
session required pam_loginuid.so
- success=1 表示此行成功后,跳过下面
- default=die 表示之后的不执行了,因为succ成功后,会抹去登录失败的记录信息
- faillock配置文件
/etc/security/faillock.conf
dir = /var/log/faillock
deny = 5
fail_interval = 180
unlock_time = 600
even_deny_root # root也受限
root_unlock_time = 60
测试
faillock --dir /var/log/faillock --user root
faillock --dir /var/log/faillock --user root
root:
When Type Source Valid
2021-04-21 09:49:49 RHOST 172.16.254.216 V
2021-04-21 09:49:52 RHOST 172.16.254.216 V
- v表示有效,i表示无效
faillock命令
faillock --reset # 解锁所有用户
faillock --user user --reset # 解锁一个用户账户