default password attempts parameter

[Todd McDaniel_1]

Okay, let me as my question a different way.

On a non-trusted host, what is the mechanism that kicks you off the session after 3 failed attempts?

I dont believe there are any scripts on my box that run as daemons which do this. However, something does kick you off after 3 failed attempts.

My .profile and /etc/profile dont have anything related to this, nor does the /etc/default/security file.

Where is the default setting/built-in that kicks users off after 3 failed attempts?

My OS is 11.00.

[Todd McDaniel_1]

I found this regarding the security file. and I also found the /etc/pam.conf file which refers to /usr/lib/security/libpam_unix.1 file...


===========================================
AUTH_MAXTRIES This attribute controls whether an account is locked after too many consecutive authentication failures. It does not apply to trusted systems. This attribute is supported for users in all name server switch repositories, such as local, NIS and LDAP. This attribute is enforced in the pam_hpsec service module, and requires that the pam_hpsec module be configured in /etc/pam.conf. See pam_hpsec(5). Other PAM service modules in your configuration may enforce additional restrictions. The system-wide default defined here may be overridden by defining a per-user value in /var/adm/userdb (described in userdb(4)).

When an account has been locked due to too many authentication failures, root can unlock the account by this command:

userdbset -d -u username auth_failures

AUTH_MAXTRIES=0 Any number of authentication retries is allowed.

AUTH_MAXTRIES=N An account is locked after N+1 consecutive authentication failures. N can be any positive integer.

Default value: AUTH_MAXTRIES=0
==============================================

[Steven E. Protter]

Shalom again,

Well you found the smoking gun. I've never seen that in an 11.00 system. Do you know how it got there and if it really works?

SEP

[Tim Nelson]

Todd, I am not sure if the PAM settins or /etc/securitty/defaults apply to non-trusted systems.

An excerpt from the login man page states:
After three unsuccessful login attempts, a HANGUP signal is issued.
If a login is not successfully completed within a certain period of
time (for example, one minute), the terminal is silently disconnected.

With no mention of if it is configurable, but the man page for security does not state if Trusted environment is required either. Maybe change the setting for unsuccessfull and see if it works. ( I am sure you are already going down this path ).

Regards,

[Todd McDaniel_1]

Steven,

I was reading the 11.11 v3 man page. I was just curious if that was a feature of 11.00.

I do have the pam.conf file as well.


I will look at the login man page as well and read what it says there about the default value.


thanks guys!

[Sandman!]

Check the man page of pam_authenticate(3). Seems like the parameter of interest maybe PAM_MAXTRIES.

~cheers