Account Lockout in Solaris 8

[Kenneth Denski]

Does anyone know if it is possible to implement account lockouts in Sun Solaris 8? I want to set it so that after 3 bad login attempts, the user is locked out and must be reset by the Admin.

Is there any way to do this?

[Kevin L Prigge]

Post by Kenneth Denski
Does anyone know if it is possible to implement account lockouts in Sun Solaris 8? I want to set it so that after 3 bad login attempts, the user is locked out and must be reset by the Admin.
Is there any way to do this?

Not with stock Solaris 8, AFAIK. I'm guessing you've been tasked
with implementing this based on a requirement from your Audit area.

Make sure they know that there are real DOS possibilities with a
scheme such as this, and just because this functionality was available
on IBM mainframes, it doesn't make it a good or useful idea.

[Glenn M. Brunette, Jr.]

Kenneth,

This capability does not exist natively on the Solaris 8 OS. If you
need this capabilitity, it can be added through the use of PAM and
possibly some secondary functionality. Note that depending on the
naming service that you use and your expectations of whether this
lockout will be per-system or network wide, there are some
significant issues/tradeoffs that would need to be discussed.

Also, per Kevin's e-mail, there are also a few DOS possibilities
that exist using this method - although there are also some ways
in which those risks can be mitigated to some degree.

SunPS has built and delivered modules that perform this functionality
for a number of users. If you are interested in something like this
please let me know.

Regards,
g

---
Glenn M. Brunette, Jr.
Principal Engineer, Chief Security Architect
Sun Professional Services, United States CTO
Sun Microsystems, Inc.

Post by Kevin L Prigge

Post by Kenneth Denski
Does anyone know if it is possible to implement account lockouts in Sun Solaris 8? I want to set it so that after 3 bad login attempts, the user is locked out and must be reset by the Admin.
Is there any way to do this?

Not with stock Solaris 8, AFAIK. I'm guessing you've been tasked
with implementing this based on a requirement from your Audit area.
Make sure they know that there are real DOS possibilities with a
scheme such as this, and just because this functionality was available
on IBM mainframes, it doesn't make it a good or useful idea.
--
Kevin Prigge, SCNA #
Internet Services #
University of Minnesota #

[b***@ns1.sanjayp.com]

Post by Kevin L Prigge

Post by Kenneth Denski
Does anyone know if it is possible to implement account lockouts in Sun Solaris 8? I want to set it so that after 3 bad login attempts, the user is locked out and must be reset by the Admin.
Is there any way to do this?

Not with stock Solaris 8, AFAIK. I'm guessing you've been tasked
with implementing this based on a requirement from your Audit area.
Make sure they know that there are real DOS possibilities with a
scheme such as this, and just because this functionality was available
on IBM mainframes, it doesn't make it a good or useful idea.

If the machines are internal to your network then DoS attacks should not
be a major factor in this. The best way to do this is to use PAM
modules and customize it for your environment. This may not be the
simplist method but it will get you where you want to go. Take a look
at the /etc/default/passwd options as well. They wont let you disable
an account this way but will allow you to force other options.

Sanjay

[Darren Hoch]

Hello Kenneth,

Solaris 8 does not provide this feature by default. However, you can
install some GPL modules from:

http://www.comsmiths.com.au/pam/

They have a login_limit pam module that can be inserted into the stack.
I have used it both on Solaris 8 and Solaris 9.

Darren

Post by Kenneth Denski
Does anyone know if it is possible to implement account lockouts in Sun Solaris 8? I want to set it so that after 3 bad login attempts, the user is locked out and must be reset by the Admin.
Is there any way to do this?

[Rex Monty di Bona]

Hello Kenneth,
Thank you Darren for the wonderful plug. Yes, we have modules that you
can download and use for free. If you want the source code for an audit
it can be arranged. Please make sure that you are running version 1.04
(there was a security hole in 1.03 - obviously not enough auditing).
People at version 1.03 please upgrade.

You can select one of three behaviours with our PAM module: Lock the
account and have the password reset by admin. Lock the account and have
the login flag reset by admin (i.e. things that use the password, but
not the module will still work), and lockout for a period after the
selected number of bad attempts.

The advantage of the lockout period is that it defeats the multi-trial
attempts, and allows the user to know that something has happened
(especially if you set it to 1 day or there abouts) but does not require
admin intervetion - no social engineering attacks.

We have a bunch of other PAM modules available for other purposes too.

Rex di Bona
Computer Smiths

Post by Darren Hoch
Hello Kenneth,
Solaris 8 does not provide this feature by default. However, you can
http://www.comsmiths.com.au/pam/
They have a login_limit pam module that can be inserted into the stack.
I have used it both on Solaris 8 and Solaris 9.
Darren

Post by Kenneth Denski
Does anyone know if it is possible to implement account lockouts in
Sun Solaris 8? I want to set it so that after 3 bad login attempts,
the user is locked out and must be reset by the Admin.
Is there any way to do this?

[Steve Barnet]

According to the login(1) man page from a Solaris 8 machine,
the following variables can be set in /etc/default/login:

RETRIES
Sets the number of retries for logging in (see
pam(3PAM)). The default is 5.

SYSLOG_FAILED_LOGINS
Used to determine how many failed login attempts
will be allowed by the system before a failed
login message is logged, using the syslog(3C)
LOG_NOTICE facility. For example, if the vari-
able is set to 0, login will log all failed
login attempts.

I don't have a Solaris machine immediately at hand, but I think
that would be a good place to start.

Best,

---Steve

[James Poland]

DISABLETIME can be set in /etc/default/login on Solaris 9. It is the time
that the account is disabled after RETRIES number of unsuccessful logins.
Default is 20 seconds for DISABLETIME, 5 attempts for RETRIES. You can set
up a Windows-like timed lockout using DISABLETIME and RETRIES on Solaris 9.
SLEEPTIME can also be set in /etc/default/login. It is the amount of time
that the system pauses between when the user enters a bad password and when
the system prompts for the user id. Default is 4 seconds, range is 0 to 5.

DISABLETIME is not in Solaris 8. You can use someone else's PAM, or as Julie
Baumler suggested, roll your own lockout script. /var/adm/loginlog is the
record each bad login attempt after 5 bad attempts. Check the manpage.

I like the Linux PAM. See http://www.kernel.org/pub/linux/libs/pam/. Don't
know how it would behave on Solaris, but you might give it a shot. See
pam_tally for the lockout function lib.

jp



-----Original Message-----
From: Steve Barnet [mailto:***@chem.wisc.edu]
Sent: Tuesday, October 14, 2003 10:56 AM
To: Kevin L Prigge
Cc: Kenneth Denski; focus-***@securityfocus.com
Subject: Re: Account Lockout in Solaris 8



According to the login(1) man page from a Solaris 8 machine,
the following variables can be set in /etc/default/login:

RETRIES
Sets the number of retries for logging in (see
pam(3PAM)). The default is 5.

SYSLOG_FAILED_LOGINS
Used to determine how many failed login attempts
will be allowed by the system before a failed
login message is logged, using the syslog(3C)
LOG_NOTICE facility. For example, if the vari-
able is set to 0, login will log all failed
login attempts.

I don't have a Solaris machine immediately at hand, but I think
that would be a good place to start.

Best,

---Steve

[Darren J Moffat]

Post by James Poland
DISABLETIME can be set in /etc/default/login on Solaris 9. It is the time
that the account is disabled after RETRIES number of unsuccessful logins.
Default is 20 seconds for DISABLETIME, 5 attempts for RETRIES. You can set
up a Windows-like timed lockout using DISABLETIME and RETRIES on Solaris 9.
SLEEPTIME can also be set in /etc/default/login. It is the amount of time
that the system pauses between when the user enters a bad password and when
the system prompts for the user id. Default is 4 seconds, range is 0 to 5.

It is as you say the amount of time the system pauses but it does NOTHING
to the actual account. It is very easily defeated if it is a network
connection because you just drop the connection from the client and start
again. This is really intended to assist in protection of directly attached
serial (or framebuffer) connections not network.

Post by James Poland
DISABLETIME is not in Solaris 8. You can use someone else's PAM, or as Julie
Baumler suggested, roll your own lockout script. /var/adm/loginlog is the
record each bad login attempt after 5 bad attempts. Check the manpage.

loginlog is only written by login(1). dtlogin(1) doesn't write there,
neither does ftp or sshd.

If you want to do it this way then use the Solaris BSM Audit functionality
and turn on the lo class.

--
Darren J Moffat

[BAUMLER Julie L]

-----Original Message-----
Sent: Tuesday, October 14, 2003 9:29 AM
To: Kenneth Denski
Subject: Re: Account Lockout in Solaris 8

Post by Kenneth Denski
Does anyone know if it is possible to implement account

lockouts in Sun Solaris 8? I want to set it so that after 3
bad login attempts, the user is locked out and must be reset
by the Admin.

Post by Kenneth Denski
Is there any way to do this?

A) Write/port your own PAM module.

B) Adjust the variables in /etc/default/login to log to syslog after 3 bad
attempts, have a x(x=relatively long) SLEEPTIME, set retries to 4.
(Optionally, adjust syslog.conf so these messages go to a log file of their
own.) Use a log file reading tool (such as swatch or roll your own) to
check for messages every y(y<x) seconds, parse out the username and issue
"passwd -l <username>".

Make sure they know that there are real DOS possibilities with a
scheme such as this, and just because this functionality was available
on IBM mainframes, it doesn't make it a good or useful idea.

Also, in general, password reset proceedures tend to have weaknesses that
are open to social engineering. How do you verify users in remote
buildings (or who are traveling)? How do you securely get them their new
password without being subject to some sort of evesdropping or known
password attack? If you use the phone what do you do when phone service is
out for that site? How do you securely reset a password for a deaf user at
a remote site? How many times would a user have to get locked out in a row
before you realized that the problem wasn't their inability to type in the
password you gave them, but someone continuing a password guessing attack?
What if they ended up at a different help desk tech each time? (Even if
it's not your plan today, this will eventually cause enough work to get
turned over to the help desk.)

Julie

Julie L Baumler, SCNA
Sr Systems Administrator
Multnomah County IT
503-988-3749 x26909

[Darren J Moffat]

On Tue, 14 Oct 2003, Kenneth Denski wrote:

Does anyone know if it is possible to implement account lockouts in Sun Solaris 8? I want to set it so that after 3 bad login attempts, the user is locked out and must be reset by the Admin.

Post by Kenneth Denski
Is there any way to do this?

There is a consulting special available from Sun PS. Please contact
***@Sun.COM


--
Darren J Moffat

[k***@us.pwc.com]

Thanks to everyone who responded to my question re: Solaris account
lockout. Lots of great answers, I am going to evaluate all of the
possibilities and come up with a solution.

Ken Denski





Kevin L Prigge
<***@tc.umn.edu> To: Kenneth L Denski/US/ABAS/***@Americas-US
10/14/2003 09:28 cc: focus-***@securityfocus.com
AM Subject: Re: Account Lockout in Solaris 8

Post by Kenneth Denski
Does anyone know if it is possible to implement account lockouts in Sun

Solaris 8? I want to set it so that after 3 bad login attempts, the user is
locked out and must be reset by the Admin.

Post by Kenneth Denski
Is there any way to do this?

Not with stock Solaris 8, AFAIK. I'm guessing you've been tasked
with implementing this based on a requirement from your Audit area.

Make sure they know that there are real DOS possibilities with a
scheme such as this, and just because this functionality was available
on IBM mainframes, it doesn't make it a good or useful idea.

--
Kevin Prigge, SCNA #
Internet Services #
University of Minnesota #




_________________________________________________________________
The information transmitted is intended only for the person or
entity to which it is addressed and may contain confidential
and/or privileged material. Any review, retransmission,
dissemination or other use of, or taking of any action in reliance
upon, this information by persons or entities other than the
intended recipient is prohibited. If you received this in error,
please contact the sender and delete the material from any
computer.