Need to change system value of "Unsuccessful login tries"

[Dani Seely]

Maximum number of unsuccessful login tries as noted in SAM shows a value of 5. When changing the value via SAM, the t_umaxtries entry in /tcb/files/auth/system/default is changed. I need to change this to a value of 3 and want to do this via the command line.

I have trapped the command used by SAM to check the value (/usr/lbin/getprdef) but I cannot determine the command used by SAM to set the value.

What is the command at the command line to change the t_umaxtries (not the u_umaxtries)?

[Steven E. Protter]

This is done with the passwd command.

You can get the sytax from the man page and then use this program to update all users.

See attachment.

This program is a hack i used for another purpose. It uses a copy of the /etc/passwd file to get the user name.

You WILL have to change it to get it to work with your chosen passwd command.

SEP

[Darren Prior · Accepted solution]

Hi,

t_maxtries is the maximum number of login tries to a terminal, whereas u_maxtries is the maximum number of login tries to a user's account (as described in ttys(4) and prpwd(4) man pages.) As such it won't be modified by using modprpw or passwd - these both act on an individual user's entries.

Although u_maxtries can be changed using modprpw, which is documented, there isn't a supported command line equivalent for changing t_maxtries. The actual command used is modprdef, but it isn't designed for use outside SAM. There's a document that explains why in the Knowledge Base: KBRC00005452.

The value in the default file is the global value, and is overwritten by any specific values in the ttys file.

regards,

Darren.

[Dani Seely]

Received my solution from ITRC and thought I'd share it with the forum (thanks George) ...

The t_maxtries in the /tcb/files/auth/system/default file applies only to terminals and modems connected to a serial or mux card.

The u_maxtries in the /tcb/files/auth/system/default file specifies the maximum number of consecutive unsuccessful login attempts to the account
that are permitted until the account is locked.

To change either from the command line you would run the following. You can verify that it's been changed by doing a more on the default file. There are no man pages for either of these commands.

1) For t_maxtries:
Example:
/usr/lbin/modprterm -m tmaxtries=25

2) For u_maxtries:
Example:
/usr/lbin/modprdef -m umaxlntr=9

From SAM's help screen for t_maxtries:
Unsuccessful Login Tries Allowed

When someone attempts to log in and gives an incorrect login name or password, the attempt fails. The person trying to log in may be an authorized regular system user who forgot the account password, or an unauthorized person attempting to break into the system by trying various login names and passwords. Setting a hard limit on the number
of failed login attempts through a terminal or modem device provides a degree of protection against attacks by unauthorized users of that device as well as a highly visible means of discovering such attacks so
they can be traced. Of course, locking a port due to login errors is inconvenient for other users who need access to that terminal or modem, so a reasonable balance between user convenience and system security is important.

Use this field to specify the maximum number of login attempts allowed, on a given terminal or modem port, system-wide, by typing the desired value in the field labeled Unsuccessful Login Tries Allowed. Use the [Back space] and the right- and left-arrow keys to correct any typographical errors.

NOTE: The login tries limit applies only to terminals and modems connected through a serial interface card or MUX. It does not provide protection against attacks through LAN connections being accessed from remote
systems.