From c75c3ff9f2c3d221aabe89b8d0779f041e71e30c Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Fri, 7 Jan 2005 13:52:42 +0000 Subject: Relevant BUGIDs: Red Hat bz 60930 Purpose of commit: bugfix, new feature Commit summary: --------------- major rewrite of the pam_tally module --- doc/modules/pam_tally.sgml | 131 ++++++++++++++++++++++++--------------------- 1 file changed, 69 insertions(+), 62 deletions(-) (limited to 'doc/modules/pam_tally.sgml') diff --git a/doc/modules/pam_tally.sgml b/doc/modules/pam_tally.sgml index eeb05518..44c6f4ed 100644 --- a/doc/modules/pam_tally.sgml +++ b/doc/modules/pam_tally.sgml @@ -18,6 +18,7 @@ pam_tally Author[s]: Tim Baverstock +Tomas Mraz Maintainer: @@ -61,9 +62,7 @@ want to use the supplied appliction.

Note, there are some outstanding issues with this module: pam_tally is very dependant on getpw*() - a database -of usernames would be much more flexible; the `keep a count of current -logins' bit has been #ifdef'd out and you can only reset the -counter on successful authentication, for now. +of usernames would be much more flexible Generic options accepted by both components

@@ -84,23 +83,46 @@ counter on successful authentication, for now. Recognized arguments: onerr=(succeed|fail); file=/where/to/keep/counts; -no_magic_root +deny=n; +lock_time=n; +unlock_time=n; +magic_root; +even_deny_root_account; +per_user; +no_lock_time +no_reset; Description:

-The authentication component of this module increments the attempted -login counter. +The authentication component first checks if the user should be denied +access and if not it increments attempted login counter. +Then on call to pam_setcred it resets the attempts counter +if the user is NOT magic root.

Examples/suggested usage:

-The module argument no_magic_root is used to indicate that if -the module is invoked by a user with uid=0, then the counter is -incremented. The sys-admin should use this for daemon-launched -services, like telnet/rsh/login. For user -launched services, like su, this argument should be omitted. +The deny=n option is used to deny access if tally +for this user exceeds n. + +

+The lock_time=n option is used to always deny access +for at least n seconds after a failed attempt. + +

+The unlock_time=n option is used to allow access after +n seconds after the last failed attempt with exceeded tally. +If this option is used the user will be locked out only for the specified +amount of time after he exceeded his maximum allowed attempts. Otherwise +the lock is removed only by a manual intervention of the system administrator. + +

+The magic_root option is used to indicate that if +the module is invoked by a user with uid=0, then the counter is not +incremented. The sys-admin should use this for user launched services, +like su, otherwise this argument should be omitted.

By way of more explanation, when a process already running as root @@ -109,9 +131,33 @@ bypasses pam_tally's checks: this is handy for suing from root into an account otherwise blocked. However, for services like telnet or login, which always effectively run from the root account, root (ie everyone) shouldn't be granted this -magic status, and the flag `no_magic_root' should be set in this +magic status, and the flag `magic_root' should not be set in this situation, as noted in the summary above. +

+Normally, failed attempts to access root will NOT cause the +root account to become blocked, to prevent denial-of-service: if your +users aren't given shell accounts and root may only login via +su or at the machine console (not +telnet/rsh, etc), this is safe. If you really want +root to be blocked for some given service, use +even_deny_root_account. + +

+If /var/log/faillog contains a non-zero .fail_max/.fail_locktime +field for this user then the per_user module argument will +ensure that the module uses this value and not the global +deny/lock_time=n parameter. + +

+The no_lock_time option is for ensuring that the module does +not use the .fail_locktime field in /var/log/faillog for this +user. + +

+The no_reset option is used to instruct the module to not reset +the count on successful entry. + Account component @@ -122,67 +168,28 @@ situation, as noted in the summary above. Recognized arguments: onerr=(succeed|fail); file=/where/to/keep/counts; -deny=n; -no_magic_root; -even_deny_root_account; -reset; +magic_root; no_reset; -per_user; -no_lock_time Description:

-The account component can deny access and/or reset the attempts -counter. It also checks to make sure that the counts file is a plain -file and not world writable. +The account component resets attempts counter if the user is NOT +magic root. This phase can be used optionaly for services which don't call +pam_setcred correctly or if the reset should be done regardless +of the failure of the account phase of other modules. Examples/suggested usage:

-The deny=n option is used to deny access if tally -for this user exceeds n. The presence of -deny=n changes the default for -reset/no_reset to reset, unless the user -trying to gain access is root and the no_magic_root option -has NOT been specified. +The magic_root option is used to indicate that if +the module is invoked by a user with uid=0, then the counter is not +decremented/reset. The sys-admin should use this for user launched services, +like su, otherwise this argument should be omitted.

-The no_magic_root option ensures that access attempts by root -DON'T ignore deny. Use this for daemon-based stuff, like -telnet/rsh/login. - -

-The even_deny_root_account option is used to ensure that the -root account can become unavailable. Note that magic root -trying to gain root bypasses this, but normal users can be locked out. - -

-The reset option instructs the module to reset count to 0 on -successful entry, even for magic root. The no_reset option is -used to instruct the module to not reset the count on successful -entry. This is the default unless deny exists and the user -attempting access is NOT magic root. - -

-If /var/log/faillog contains a non-zero .fail_max -field for this user then the per_user module argument will -ensure that the module uses this value and not the global -deny=n parameter. - -

-The no_lock_time option is for ensuring that the module does -not use the .fail_locktime field in /var/log/faillog for this -user. - -

-Normally, failed attempts to access root will NOT cause the -root account to become blocked, to prevent denial-of-service: if your -users aren't given shell accounts and root may only login via -su or at the machine console (not -telnet/rsh, etc), this is safe. If you really want -root to be blocked for some given service, use -even_deny_root_account. +The no_reset option is used to instruct the module to not reset +the count on successful entry. -- cgit v1.2.3