How to enable faillock using authconfig
Environment
- Red Hat Enterprise Linux 7 (RHEL 7)
Issue
- Executing
authconfig
command removes thefaillock
entries from PAM files. - Configure
faillock
for persistent settings in PAM files.
Resolution
- Enable faillock using authconfig command.
# authconfig --enablefaillock --faillockargs="deny=6 unlock_time=1200" --update
Note :
- For details of faillock
arguments, refer man page pam_faillock
.
- Above configuration places below line in file /etc/pam.d/password-auth-ac
under password
stack. This is not the right place, it needs to be corrected manually by referring /etc/pam.d/system-auth
. Bug Reference
# auth required pam_faillock.so authfail deny=6 unlock_time=1200
authconfig
command updates file/etc/sysconfig/authconfig
.
# grep -i faillock /etc/sysconfig/authconfig
FAILLOCKARGS="deny=6 unlock_time=1200"
USEFAILLOCK=yes
Root Cause
- Faillock is not enabled in file
/etc/sysconfig/authconfig
.
# grep USEFAILLOCK /etc/sysconfig/authconfig
USEFAILLOCK=no
This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.
Comments