Skill 2 in course 3.4: Network and Access

PAM and Account Policy

Change PAM safely with authselect, enforce lockout, password quality and aging, and diagnose login failures.

Advanced3 lessons9 exercises2 h 40 min
Start skill

You will be able to

  • Explain the four PAM management groups, control flags and how authselect generates the files under /etc/pam.d.
  • Configure account lockout, password quality and password aging, and show their effect.
  • Find why a user cannot log in: password, expiry, lock, shell, PAM restrictions, sshd rules or labels.

Lessons

  1. 01How PAM decides, and authselectRead a PAM stack line by line, understand control flags, and change it the supported way with authselect.authselectauthselect currentauthselect listauthselect selectauthselect enable-featureauthselect apply-changes0/3 exercises
  2. 02Lockout, password quality and password agingConfigure faillock, pwquality and password aging, read the state of an account and unlock it correctly.faillockfaillock --userfaillock --reset/etc/security/faillock.conf/etc/security/pwquality.confpwscore0/3 exercises
  3. 03Why can't this user log in?Work through password, account state, shell, PAM restrictions, sshd rules and SELinux labels using the logs.journalctl _COMM=sshd/var/log/securesshd -Tsshd -tausearch -m user_authlast0/3 exercises