2

When logging into solaris, the user will normally get a username+password prompt.

If the password entered is wrong the prompt just re-appears, and it will just keep going without providing any indication of when a lockout has occurred.

Is there a way to modify this behaviour in Solaris version 9/10?

2
  • 2
    No way to change it because that is the correct security behaviour - not revealing why you can't authenticate.
    – user111439
    Apr 22 '15 at 10:05
  • That can be a question of security policy choice. Revealing the condition of the lock account state, does not amount to a gaping security exposure.
    – user55570
    Apr 23 '15 at 12:15
0

I agree that revealing no information is the correct security behavior. You may not consider it a gaping security exposure but most do as it can give someone an idea on if the account name is valid.

If you really want the reason for the login failure known, the only method I'm aware of is to write your own PAM module and add it to the PAM stack.

1
  • I suspect there is no "correct" behaviour as such here. To restrict behaviour into one rigid form seems to indicate a lack of openness.
    – user55570
    Jan 26 '17 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.