From 9ada0093e92388590c7368600ca4e9e3e376f0d0 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 16:22:51 +0200 Subject: Adding upstream version 1.5.2. Signed-off-by: Daniel Baumann --- modules/pam_faillock/faillock.conf.5.xml | 253 +++++++++++++++++++++++++++++++ 1 file changed, 253 insertions(+) create mode 100644 modules/pam_faillock/faillock.conf.5.xml (limited to 'modules/pam_faillock/faillock.conf.5.xml') diff --git a/modules/pam_faillock/faillock.conf.5.xml b/modules/pam_faillock/faillock.conf.5.xml new file mode 100644 index 0000000..04a8410 --- /dev/null +++ b/modules/pam_faillock/faillock.conf.5.xml @@ -0,0 +1,253 @@ + + + + + + + faillock.conf + 5 + Linux-PAM Manual + + + + faillock.conf + pam_faillock configuration file + + + + + DESCRIPTION + + faillock.conf provides a way to configure the + default settings for locking the user after multiple failed authentication attempts. + This file is read by the pam_faillock module and is the + preferred method over configuring pam_faillock directly. + + + The file has a very simple name = value format with possible comments + starting with # character. The whitespace at the beginning of line, end + of line, and around the = sign is ignored. + + + + + + OPTIONS + + + + + + + + The directory where the user files with the failure records are kept. The + default is /var/run/faillock. + + + + + + + + + + Will log the user name into the system log if the user is not found. + + + + + + + + + + Don't print informative messages to the user. Please note that when + this option is not used there will be difference in the authentication + behavior for users which exist on the system and non-existing users. + + + + + + + + + + Don't log informative messages via syslog3. + + + + + + + + + + Only track failed user authentications attempts for local users + in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users. + The faillock8 + command will also no longer track user failed + authentication attempts. Enabling this option will prevent a + double-lockout scenario where a user is locked out locally and + in the centralized mechanism. + + + + + + + + + + Don't enforce a delay after authentication failures. + + + + + + + + + + Deny access if the number of consecutive authentication failures + for this user during the recent interval exceeds + n. The default is 3. + + + + + + + + + + The length of the interval during which the consecutive + authentication failures must happen for the user account + lock out is n seconds. + The default is 900 (15 minutes). + + + + + + + + + + The access will be re-enabled after + n seconds after the lock out. + The value 0 has the same meaning as value + never - the access + will not be re-enabled without resetting the faillock + entries by the faillock8 command. + The default is 600 (10 minutes). + + + Note that the default directory that pam_faillock + uses is usually cleared on system boot so the access will be also re-enabled + after system reboot. If that is undesirable a different tally directory + must be set with the option. + + + Also note that it is usually undesirable to permanently lock + out users as they can become easily a target of denial of service + attack unless the usernames are random and kept secret to potential + attackers. + + + + + + + + + + Root account can become locked as well as regular accounts. + + + + + + + + + + This option implies option. + Allow access after n seconds + to root account after the account is locked. In case the + option is not specified the value is the same as of the + option. + + + + + + + + + + If a group name is specified with this option, members + of the group will be handled by this module the same as + the root account (the options + and will apply to them. + By default the option is not set. + + + + + + + + EXAMPLES + + /etc/security/faillock.conf file example: + + +deny=4 +unlock_time=1200 +silent + + + + + FILES + + + /etc/security/faillock.conf + + the config file for custom options + + + + + + + SEE ALSO + + + faillock8 + , + + pam_faillock8 + , + + pam.conf5 + , + + pam.d5 + , + + pam8 + + + + + + AUTHOR + + pam_faillock was written by Tomas Mraz. The support for faillock.conf was written by Brian Ward. + + + + -- cgit v1.2.3