RE: Account Lockout in Solaris 8

From: BAUMLER Julie L (julie.x.baumler_at_co.multnomah.or.us)
Date: 10/14/03

  • Next message: Glenn M. Brunette, Jr.: "Re: Account Lockout in Solaris 8" 
    To: "'focus-sun@securityfocus.com'" <focus-sun@securityfocus.com>, "'kenneth.l.denski@us.pwc.com'" <kenneth.l.denski@us.pwc.com>
Date: Tue, 14 Oct 2003 11:33:28 -0700

    > -----Original Message-----
    > From: Kevin L Prigge [mailto:klp@tc.umn.edu]
    > Sent: Tuesday, October 14, 2003 9:29 AM
    > To: Kenneth Denski
    > Cc: focus-sun@securityfocus.com
    > Subject: Re: Account Lockout in Solaris 8
    >
    >
    > On Tue, Oct 14, 2003 at 04:09:38PM -0000, Kenneth Denski wrote:
    > >
    > >
    > > Does anyone know if it is possible to implement account
    > lockouts in Sun Solaris 8? I want to set it so that after 3
    > bad login attempts, the user is locked out and must be reset
    > by the Admin.
    > >
    > > Is there any way to do this?
    >

    A) Write/port your own PAM module.

    B) Adjust the variables in /etc/default/login to log to syslog after 3 bad
    attempts, have a x(x=relatively long) SLEEPTIME, set retries to 4.
    (Optionally, adjust syslog.conf so these messages go to a log file of their
    own.) Use a log file reading tool (such as swatch or roll your own) to
    check for messages every y(y<x) seconds, parse out the username and issue
    "passwd -l <username>".

    >
    > Make sure they know that there are real DOS possibilities with a
    > scheme such as this, and just because this functionality was available
    > on IBM mainframes, it doesn't make it a good or useful idea.

    Also, in general, password reset proceedures tend to have weaknesses that
    are open to social engineering. How do you verify users in remote
    buildings (or who are traveling)? How do you securely get them their new
    password without being subject to some sort of evesdropping or known
    password attack? If you use the phone what do you do when phone service is
    out for that site? How do you securely reset a password for a deaf user at
    a remote site? How many times would a user have to get locked out in a row
    before you realized that the problem wasn't their inability to type in the
    password you gave them, but someone continuing a password guessing attack?
    What if they ended up at a different help desk tech each time? (Even if
    it's not your plan today, this will eventually cause enough work to get
    turned over to the help desk.)

    Julie

    Julie L Baumler, SCNA
    Sr Systems Administrator
    Multnomah County IT
    503-988-3749 x26909

  • Next message: Glenn M. Brunette, Jr.: "Re: Account Lockout in Solaris 8"

    Relevant Pages

    • Re: password change
      ... Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strComputer ... ' Open the log file for write access. ... is not reset to a separate text file of "missed" computers. ...
      (microsoft.public.windows.server.general)
    • Re: Chassis intrusion detected
      ... Contact your Help Desk if you did not personally open your chassis. ... I have went to setup and it askes me for a but my password ... how do i get in to reset the password or reset to clear or reset to no ...
      (microsoft.public.security)
    • AD Permissions Problem
      ... my Help Desk personal have the ability to reset and change user ... What I mean is in credit for example, ... they will be able to reset all the user passwords, except one or two which is ...
      (microsoft.public.windows.server.active_directory)
    • Re: Resetting AD Password
      ... try this code example to reset the password... ... ' generate a new strong random password ... The reason that I can't use the password question ... We can enforce that the help desk operator be in an AD group and check ...
      (microsoft.public.dotnet.security)
    • ASP engine siezes
      ... the log file to the group. ... >We run a shared server with roughly 200 domains, ... >connections 'Too many connections'. ... >after IIS being reset or 10 days, ...
      (microsoft.public.inetserver.iis)