47 lines
2.3 KiB
Diff
47 lines
2.3 KiB
Diff
|
From e9d570e068bbb5ae1fd91a86b186cecf488ac771 Mon Sep 17 00:00:00 2001
|
|||
|
|
From: liuxinhao <liuxinhao@kylinsec.com.cn>
|
|||
|
|
Date: Tue, 30 May 2023 09:25:03 +0800
|
|||
|
|
Subject: [PATCH 2/5] fix(pam conf): Adjust the number of non-password
|
|||
|
|
authentication failures recorded in the PAM configuration file
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
- 调整PAM配置文件，多路认证非密码认证失败记录错误次数
|
|||
|
|
|
|||
|
|
Closes #I7937W
|
|||
|
|
---
|
|||
|
|
data/kiran-authentication-service | 15 ++++++++++-----
|
|||
|
|
1 file changed, 10 insertions(+), 5 deletions(-)
|
|||
|
|
|
|||
|
|
diff --git a/data/kiran-authentication-service b/data/kiran-authentication-service
|
|||
|
|
index e5d0f98..afc7e17 100644
|
|||
|
|
--- a/data/kiran-authentication-service
|
|||
|
|
+++ b/data/kiran-authentication-service
|
|||
|
|
@@ -1,11 +1,16 @@
|
|||
|
|
-# 多路认证模式，成/功则认证通过，失败/切换到密码 跳过多因子认证模式
|
|||
|
|
-auth [success=done ignore=ignore default=die] pam_kiran_authentication.so doauth
|
|||
|
|
+# NOTE:需要将/etc/pam.d/system-auth中pam_faillock中控制流程字段由required修改为requisite
|
|||
|
|
+# 若不修改，用户已锁定也能开始认证，无论认证是否成功都会失败，并且无提示。
|
|||
|
|
|
|||
|
|
+# =========================认证配置项目================================ #
|
|||
|
|
+# 多路认证模式，成/功则认证通过，失败/切换到密码 跳过多因子认证模式
|
|||
|
|
+auth [success=done ignore=2 default=die] pam_kiran_authentication.so doauth
|
|||
|
|
# 多因子认证模式, 成功继续执行PAM流程栈,失败或默认值都为失败
|
|||
|
|
-#auth requisite pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=60
|
|||
|
|
#auth [success=2 default=bad] pam_kiran_authentication.so doauth
|
|||
|
|
-#auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
|||
|
|
-#auth required pam_debug
|
|||
|
|
+# ==================================================================== #
|
|||
|
|
+
|
|||
|
|
+# 认证服务后续认证流程兼容，走系统错误计数failock, pam_debug只是修改认证状态值为成功
|
|||
|
|
+auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
|||
|
|
+auth required pam_debug
|
|||
|
|
|
|||
|
|
# 认证成功，清理内部记录错误次数
|
|||
|
|
account required pam_kiran_authentication.so authsucc
|
|||
|
|
\ No newline at end of file
|
|||
|
|
--
|
|||
|
|
2.33.0
|
|||
|
|
|