![无法使用 pam_tally2.so PAM 模块锁定非 root RHEL 帐户](https://linux22.com/image/1423410/%E6%97%A0%E6%B3%95%E4%BD%BF%E7%94%A8%20pam_tally2.so%20PAM%20%E6%A8%A1%E5%9D%97%E9%94%81%E5%AE%9A%E9%9D%9E%20root%20RHEL%20%E5%B8%90%E6%88%B7.png)
/etc/pam.d/system-auth
我有 RHEL 5.5,并在文件中进行了以下更改:
auth required pam_env.so
auth required pam_tally2.so deny=3 onerr=fail
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account required pam_tally2.so
account required pam_unix.so nullok try_first_pass
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
但这并不像预期的那样工作。在几次登录失败后,我确实看到了消息account locked
,但之后它仍然要求输入密码,即使我输入了正确的密码,它也会显示以下内容:
[student@server3 ~]$ su - testuser
Your account is locked. Maximum amount of failed attempts was reached.
Password:
su: incorrect password
但作为root
用户我仍然可以登录到用户:
[root@server3 ~]# su - testuser
[testuser@server3 ~]$
这表明用户实际上并未被锁定。这难道不正确吗?我做错了什么?
答案1
没什么不对,这是预期的行为。作为 root,您可以绕过身份验证。
不是每个人都有 root 权限,希望如此...