User able login after 3 failed attempts

[Ray Allen_1]

Hi All,

A user was able to login after 3 failed login attempts.
How can set the number of failed login attempts?
The systems are NON-trusted systems running 11.23 in a Service Guard environment?
I know that going to trusted system would be better, but for now, I just need to figure out how to fix this number of failed login attempts problem.
In the mean time, if someone is willing to provide step by step instructions, or point to a document that explains how to go to a trusted system in Service Guard environment, that would great also.

Thanks in advance for your help.

[Jaime Bolanos Rojas.]

Ray to accomplish what you want in an untrusted system please take a look at this post:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=597942

Regards,

Jaime.

[Steven E. Protter · Accepted solution]

Shalom,

There is no mechanism other than scripting to disable accounts on non-trusted systems after three failed login attempts.

Its kind of tricky, because trusted systems look for three consecutive failed logins.

strings /var/adm/btmp | awk '{print $1}' | sort -u > /tmp/checkfile

# You may need to use something other than $1, my HP-9000 servers at home are turned off to converve my bank account(Chasmal Yisrael eg electric company).

After you get check file.

while read -r username
do
badlog=$(strings /var/adm/btmp grep $username | wc -l)
if [ $badlog -ge 3 ] then
passwd -l $username
fi
done < /tmp/checkfile

rm -f /tmp/checkfile


You might want to insert some code to drop the offending user an email. Because this mechanism is unable to check consecutive bad logins like trusted, you must either improve it or I'd recommend setting the threashold higher.

Also, you will need to periodically empty the /var/adm/btmp (might be /var/adm/syslog/btmp) file otherwise eventually all users will disable themselves.

Trusted system is somewhat easier to manage.

SEP

[Ray Allen_1]

Thanks guys.
I may be able to use the script you provided, but would the script also disable the root account. If so, is there a line I can put in the script to exclude the root account?

[Darrel Louis]

Ray,

If you've trusted mode enabled:
logins -ox \
| awk -F: '($8 != "LK" && $1 != "root") { print $1 }' \
| while read logname; do
/usr/lbin/modprpw -m umaxlntr=3 "$logname"
done
modprdef -m umaxlntr=3
echo NUMBER_OF_LOGINS_ALLOWED=3 >> /etc/default/security
Discussion:
The commands above set the number of failed login attempts a user is allowed before
being disconnected from the system and having to re-initiate their login session when running in HP-UX Trusted Mode. Setting this number to a reasonably low value helps
discourage brute force password guessing attacks.

You can download the following Document,
CIS_HPUX_Benchmark_v1.3.1.pdf at the following url for more info.
http://www.cisecurity.org/bench_hpux.html

Darrel

[Steven E. Protter]

Revision

## added the grep -v root to exclude it from the data set.
strings /var/adm/btmp | awk '{print $1}' | sort -u | grep -v root >/tmp/checkfile

# You may need to use something other than $1, my HP-9000 servers at home are turned off to converve my bank account(Chasmal Yisrael eg electric company).

After you get check file.

while read -r username
do
badlog=$(strings /var/adm/btmp grep $username | wc -l)
if [ $badlog -ge 3 ] then
passwd -l $username
# could also add logic to exclude root here before the passwd -l command
fi
done < /tmp/checkfile

rm -f /tmp/checkfile


Note, my code requires some debug testing.

SEP

[Ray Allen_1]

SEP
I do a have a question regarding the script. As I am not a scripter, I a little hazed on exactely where to put this line;

strings /var/adm/btmp | awk '{print $1}' | sort -u | grep -v root >/tmp/checkfile


And

What should I put on this line;

# could also add logic to exclude root here before the passwd -l command

[Bill Hassell]

As mentioned, there is no count of failed logins kept in HP-UX without the Trusted system database. You can scan btmp using the lastb command but this will be painful to manage (you have to exclude old entries and handle logfile cleanup). Since you're running Service Guard, this system is probably very important and subject to corporate or auditor standards. Even if you fix the 3 tries=lockout problem, your auditors will continue requiring higher levels of password and account security.

An un-Trusted system cannot meet today's security standards including automatic lockout based on failed attemps as well as rules for ctreating new passwords. You need to convert to a Trusted syst5em. Be sure to change the entry in /etc/nsswitch.conf from passwd:compat to passwd:files before converting to Trusted.

[Chrisl_2]

Hi all,

This thread got me thinking about a script that sends email to users, say about a week before their password is about to expire...(on a trusted system). Has anyone written this and willing to share it?

TIA