locking user account after 3 failed attempts

[Gea Geerts]

Hi,

Got a question for you all.

We like to lock user accounts after
three failed attempts to logon.
To convert from a untrusted system to a trusted system is a big risk for our core business applications. So if there's another way ..

We're on hp-ux 11i.

Thanks

Gea

[Steven E. Protter]

You can write a script that processs the btmp file

lastb

That ouput includes user names.

You can do this.

lastb | sort -u > list


while read -r username

badtry=$(lastb | grep -i $username | wc -l)
if [ $badtry -ge 3 ]
then
# passwd -l $username
fi
done < list

Run it as often as you want via cron.

Trusted system is better, but an iteration of the above code will work.

SEP

[Rick Garland]

Going to a trusted system is going to be much better and much easier.

SEP has a good idea but on a trusted system this count starts over again if there is a successful login.

In other words, I have 2 failed attempts to login. I succeed on 3rd try. On trusted system this count starts over again.

To work with the lastb file, if there is a successful login within 3 unsuccessful attempts, do not lock the account. Look for 3 unsuccessful attempts in a row.

[SGUX]

I agree with Rick. Going to trusted would be the easiest. You can set the amount of login-attempts and other security-settings system-wide and change this if you like per account.

the command /usr/lbin/modprpw -l -k "account" can help you getting back your password after going to trusted (which is quit simple)

[Gea Geerts]

Thank you all. We decided to leave it as it is now for the moment.

[Gea Geerts]

We'll start a project next year to go from untrusted to trusted .