maximum failed login on vt doesn't actually prevent logins

XenoTerraCide · Veteran Joined: 18 Jan 2004 Posts: 1418 Location: MI, USA

whenever I attempt to login 3 times (all failed) I get a message saying maximum attempts reached. however say on the fourth time I get my password correct I can login. this seems like a security issue to me. how do I make it have a 30 minute timeout before that user can attempt to login again or something similar.
_________________
I don't hang out here anymore, try asking on http://unix.stackexchange.com/ if you want my help.

limn · l33t Joined: 13 May 2005 Posts: 997

If you use PAM, have a look at pam_tally. Here is a page with some configuration examples.

XenoTerraCide · Veteran Joined: 18 Jan 2004 Posts: 1418 Location: MI, USA

thx will look at that. pam is the default correct?
_________________
I don't hang out here anymore, try asking on http://unix.stackexchange.com/ if you want my help.

limn · l33t Joined: 13 May 2005 Posts: 997

Yes.
For the 30 minute part, you could set a cron job to reset the tally every 30 minutes.
Keep in mind that once the tally is reached, attempts with the correct password will also fail, though the tally will not be incremented. Attempts are still permitted, but the user will not be able to connect - until the tally is reset.

XenoTerraCide · Veteran Joined: 18 Jan 2004 Posts: 1418 Location: MI, USA

yeah I figure that... but it seems like a security issue to just allow repeated attempts. especially when this was the root account although in this situation it was legit. umm... does this article cover maybe how to increase the number of allowed attempts? or does this website. I glanced at it but am going to install 2006.1 later this evening so figure I'll wait till then anyway.
_________________
I don't hang out here anymore, try asking on http://unix.stackexchange.com/ if you want my help.

limn · l33t Joined: 13 May 2005 Posts: 997

Yes. deny=N
Also have a look at
/usr/share/doc/pam-0.78-r[35]/modules/README.pam_tally.gz

beu · Posted: Sat Sep 02, 2006 9:21 am Post subject:

This is only a security issue is you use sh*tty passwords...

XenoTerraCide · Veteran Joined: 18 Jan 2004 Posts: 1418 Location: MI, USA

heh... true... to some extent although a login delay would make security stronger against a computer attempting to login. although the livecd would not let me create a 25+ character passwd using graphical interface. 25+ characters? that would appear random to a dictionary attack... they aren't to me. using upper, lower, numbers, and symbols... is that a strong password?
_________________
I don't hang out here anymore, try asking on http://unix.stackexchange.com/ if you want my help.

XenoTerraCide · Veteran Joined: 18 Jan 2004 Posts: 1418 Location: MI, USA

Gentoo Security Handbook Chapter 7 Pam

security handbook has lots of nice tips. some I think should be default... like the syslog-ng configuration. I'm 90% sure what I asked is covered in here though too. I'm going through it now.
_________________
I don't hang out here anymore, try asking on http://unix.stackexchange.com/ if you want my help.