back to labs
PAM: Lock Accounts After Failed Logins
HardLinux Security15-30 minThe brief
Enforce an account-lockout policy with pam_faillock. Two parts, per /root/case/assignment.env:
1. Set deny (REQ_DENY) and unlock_time (REQ_UNLOCK) in /etc/security/faillock.conf.
2. Wire pam_faillock into this Ubuntu box's auth stack, /etc/pam.d/common-auth: a preauth call before pam_unix and an authfail call after it, without breaking the stack's jump counts so a correct password still gets in.
The thresholds vary per session. See /root/case/brief.txt. (On RHEL the same lines go in /etc/pam.d/system-auth, managed with authselect.)
What you'll do
- Configure pam_faillock thresholds in faillock.conf
- Set a lockout count and unlock window
- Wire pam_faillock into the PAM auth stack (preauth + authfail)
- Understand how failed-login lockout is enforced
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.