1

When using faillock and other common menthods to prevent password brute force, how to display to the user that the account is locked on all attempts (login, su, sudo, doas, pam, etc)?

I feel not showing that important information to a user legitimately trying to recall their password after returning from vacation or something is detrimental to the whole process. A correct password will now be shown to be incorrect to them and cause much more trouble.

8
  • 2
    Note that if you do that, you'll allow anyone a way to find out whether or not a particular account exists on your system. That, in itself, can be useful information for an attacker, enabling social engineering or other types of attacks. You may decide that the user convenience is worth the information leak risk for you, but you should be aware of the risk.
    – telcoM
    Mar 26 at 10:35
  • 2
    You have a policy of locking out users who do not authenticate themselves appropriately. It seems this policy is working, and what you find "detrimental" is part of its intended effect. Instead of making the systems less secure by showing internal information to unauthenticated users, I would suggest reversing the policy of locking users out. Personal opinion: Locking a user's account based on failed login attempts allows disgruntled/bored coworkers to lock out everyone they know the username of.
    – Kusalananda
    Mar 26 at 10:45
  • 1
    In case you refer to the pam_faillock module with the silent option set, you could probably delete this option.
    – MC68020
    Mar 26 at 10:47
  • @telcoM if you worry about people probing for accounts on my ttys, or locally via accounts that can run sudo etc, i'd probably create a few thousand bogus accounts which won't ever login. The lockdown makes it a low target by making brute force harder even if you know the accounts.
    – gcb
    Mar 27 at 10:37
  • @Kusalananda what you describe is a very bad work environment, you can't improve it with tech. The lockdown is just to make bruteforce prohibitive.
    – gcb
    Mar 27 at 10:39

2 Answers 2

0

You could try something like fail2ban. From their own documentation:

Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system firewall rules to reject new connections from those IP addresses, for a configurable amount of time.

I'm not sure if it works for all login methods, but works great for ssh sessions. What it does (by default) is bans specific IP addresses from authenticating. The ban period depends on how many failed logins have occurred. As the attacks persist, the ban period gets longer. This reduces the number of attempts the attacker can make.

Assuming your user comes back from vacation (or is still on vacation), they should be able to login because their IP hasn't been banned.

2
  • 2
    This does not answer the OP's question of how to tell the remote user that their account is locked.
    – doneal24
    Mar 26 at 19:44
  • Based on the comments to the original post, OP may be asking an XY-problem. This is a Y solution. I could delete this answer, but I feel like making OP aware of how others tackle the problem is only a benefit.
    – Stewart
    Mar 28 at 9:32
0

as suggested in a comment by @MC68020

remove silent from /etc/security/faillock.conf or any file in /etc/pam.d/ and the lockdown messages will show up on most places.

But, as also noted on comments by @TelcoM, this might expose valid user names on the system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .