Secure/Lock accounts with PAM tally2

pam_tally2 is a PAM module to allow interaction in users interface on numbers of failed login attempt it can can reset count on success, can deny access if too many attempts fail.

this module is unique because it  not just reflect remote connection but also reflect the ttys and any system login method as it use PAM

example from tty:


some parameters

  1. deny used to block access of numbers of failed attempts
  2. unlock_time used to to set a time duration for blocked access in seconds
  3. even_deny_root root is excluded by default, you set this parameter to tell tally2 count for root too
  4. root_unlock_time same as unlock_time but  for root only


example PAM config:


to reflect the tty access we have to configure our tally2 module in /etc/pam.d/system-auth


here is our final layout for system auth

to reflect the  remote connections  that use password example sshd

we config our /etc/pam.d/password-auth with tally


notice that we have done 2 things  one in auth interface that verify the account and 2nd one in the account interface to reflect the permissions of the account


here is the  some output of /var/log/secure


as you see tally2 kills the connection 🙂

for manual interaction with tally2 counter

there is a command called pam_tally2

to remove a counter failures



password policy with pam_cracklib

cracklib pam module is method to check the password against dictionary list and gives you availability to check the strength of the password and set rules to identify the poor passwords


here is the most important parameters for this module

  1.  minlen minimal password length
  2. dcredit maximum number of digits
  3. ucredit maximum upper case letters
  4. lcredit maximum lower case letters
  5. ocredit maximum other letters not similer to the old one
  6. maxrepeat limit repeated letters
  7. reject_username check if the username inside the password to avoid this week accounts bob/bob or bob/bob123
  8. enforce_for_root this is the most important one , why ? , because if you didn’t apply it users will just notice the warrning and whatever password will be applied with the parameter will force the use to use our policy 😉
  9. dicpath set crack lib dictionary to specific passwords database base i recommend (rockyyou) database coz it contains many leaked passwords and used by  many attackers to bruteforce the system example dicpath=/var/wordlist/rockyyou.txt


time to deploy our password policy

we want to apply this for new password also we can force the users to update their passwords once they do login via this command

this command  have high impact  it will find all users with bash shell and  force them to update the password even the root  u can exclude the root by piping the output from grep and use grep -v root

example result

we will use the passwd module inside /etc/pam.d/passwd

to add our new policy


here is the output of different failed password change

BAD PASSWORD: is too similar to the old one
BAD PASSWORD: it is based on a dictionary word
BAD PASSWORD: it is based on a (reversed) dictionary word
BAD PASSWORD: it is too short



Pluggable Authentication Modules

Linux comes with a Pam Modules to help you to interact with the running services in hardening way and custom the services security to much your need.

PAM is extra Rules to Control user interfaces ( Auth,Account,Session)  layers for the applications

the applications/services should be compiled with

here is example for sshd service

Continue reading Pluggable Authentication Modules