How to stop user account from getting locked out

[Santhosh.H]

root user gets locked how to prevent

[someone_4]

You talking about locking up on failed log ins?
In sam .. users and groups .. then choose root. .. Then go to Modify Security Policies.. ->
General User Account Policies
-> Unsuccessful Login Tries Allowed: and make that a very high number. Now I think this is only on a trusted system. But I am not sure. .. can someone clear that up for me?

Richard

[Christopher McCray_1]

go into sam --> acounts for users and groups --> users

Highlight root entry and go to actions --> Modify user security policies.

There will be a password aging policy block. go into that and set it to disabled.

Have a good day

Chris

[Sridhar Bhaskarla]

Santosh,

It depends on the security policies of your trusted system. Use SAM to change the "unsuccessful Login Tries" field.

SAM -> Accounts for Users and Groups -> Users -> root -> modify security policies (Actions menu) -> General User account policies -> Unsuccessful Login Tries allowed

You can select customize and specify whatever the number of tries you want.

To make it across the board, you would go to SAM-> Auditing and Security -> System Security policies ->
General Account policies

Specify a customized value for Unsuccessful Login tries.

But you wouldn't want to make it across the board.

-Sri

[Patrick Wallek]

I assume this is a trusted system and root is getting locked out due to too many bad passwords entered.

Go into Sam

Go to Accounts for Users and Groups

Go to Users

Scroll down until you see root and select it.

Go to the Actions menu and select 'Modify users security policies'

Then select 'General Users account Policies'

Then go to 'Unsuccessful login tries allowed' Select 'Customize' from the drop down menu and put in the # that you want. I usually use 99.


Hope this helps.

[Santhosh.H]

cant we make it infinite i.e any number of attempts if yes how?

[Christopher McCray_1]

Not through sam ... it's a 2 digit field. If there is another way, I'm not aware (ie. usermod).


Chris

[Christopher McCray_1]

No option through usermod, according to man pages... side note, 99 tries should never be in danger of being reached. You should be safe with this number.

Chris

[Victor BERRIDGE]

I solved this problem by just stopping people to try to connect as root:
Force them to su!
Only allow root connection from the console, and create a second root account under another name for yourself (sysadm?) by creating the /etc/securetty file which contains the word console
Then to be sure you dont alway need to su root yourself, give yourself all privileges in restricted sam (=> sam -r)

Its not a good idea to allow more then 9 attempts for root in case there is really a hacker around just be sure you know how to reactivate the account by having a second account ready...
I also log who su-ed root in a file (name-tty-ip.address)...

Good luck
Victor