Faillog Reset All User Failed Login Attempt Record Instead of Single User
In my previous post I talked about How to Configure SLES Linux to track and log failed login attempt records. One of Planet Malaysia Blog reader sent me an email asked me for help regarding an issue “faillog command reset all user failed login attempt record instead of single user on Linux“.
After checked and I found out the issue because of faillog option:
Reset all user failed login attempt record
#faillog -r -u user1
Only reset username: user1
#faillog -u user1 -r
So basically “faillog -u username -r” is the correct option to reset faillog for single user.
Possibly Related Posts:
- How to add Dell PERC Drivers into VMware Converter Cold Clone ISO
- Top 10 Free Anti Virus
- Microsoft SQL 2008 Agent not starts
- VMware Workstation 7 Serial Key
- WP Contact Form III – You do not have sufficient permissions to access this page Error
How to Configure SLES Linux to track and log failed login attempt records
Did you know how to lock user account after too many login failures? Under Linux, you can enable this functionality using PAM and faillog.
To provide the account locking functionality, we need to add a PAM module called pam_tally. Basically I’ll show you ‘how to configure track and log failed login attempt records on a SLES Linux host‘ and how to prevent a potential denial of service attack from the repeated locking of user accounts. Beware!
You can use faillog command to display faillog records or set login failure limits. Faillog formats the contents of the failure log from /var/log/faillog database log file. If you don’t have /var/log/faillog, initially you can type: touch /var/log/faillog
For PAM Configuration, pam_tally.so module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail. Probably you may refer to http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_tally.html
For SuSE Linux, edit /etc/pam.d/sshd and add:
auth required pam_tally.so no_magic_root
account required pam_tally.so deny=5 no_magic_root lock_time=180 onerr=fail reset per_user
Possibly Related Posts:
- How to add Dell PERC Drivers into VMware Converter Cold Clone ISO
- Top 10 Free Anti Virus
- How to Install Webmin on OpenFiler
- Microsoft SQL 2008 Agent not starts
- VMware Workstation 7 Serial Key