Limit login attempts without trusted system

[jmb]

Is there a way to limit the number of times a password can fail before the account is automatically locked? I see /etc/default/security, but no way to handle that particular parameter.

Perhaps a trusted system is the only way?

[A. Clay Stephenson · Accepted solution]

Unless you feel up to writing your own custom login program and a database to keep up with login attempts then Trusted is your only option. In the Old Days of UNIX, when dinosaurs roamed the Earth, it was quite common to do your own login.

[Sridhar Bhaskarla]

Hi,

I believe you cannot enforce the account lockout on bad login attempts without converting the system to trusted. You can apply quite a few restrictions with /etc/default/security (man security for more information). But this feature is available with trusted systems.

-Sri

[Michael Tully]

The only way is trusted. I wasn't around with the dinosaurs, but I do remember reading about these custom logins.

signed T-Rex

[jmb]

OK, that's what I thought..

And on a related issue, are there any "gotchas" with converting to trusted? I've read previous threads about losing current passwords, and also keeping a couple of root sessions going until after the conversion.

Can this be convert be done on larger, older (11.0, 11i)) systems with relative ease? Any reasons to NOT do it?

[Sridhar Bhaskarla]

Hi,

This can be done relatively easy. Make sure the following

1. encrypted password entries from /etc/passwd are not being used by anything on the system.
2. User accounts will be immediately expired. After converting the system to trusted, immediately un-expire the passwords. You can do it through either by SAM or with the command '/usr/lbin/modprdef -m exptm=0"

You may face issues with the users that have the passwords longer than 8 chars before. Ask them use only the first 8 chars until they change their passwords.

You can use the command 'tsconvert' to convert and 'tsconvert -r' to unconvert.

-Sri