配置文件
ls /etc/pam.d/ chfn crond login passwd remote runuser-l smtp ssh-keycat sudo-i system-auth-ac chsh fingerprint-auth newrole password-auth run_init smartcard-auth smtp.postfix su su-l config-util fingerprint-auth-ac other password-auth-ac runuser smartcard-auth-ac sshd sudo system-auth
认证插件
ls /lib64/security/
此模块的功能是，登陆错误输入密码3次，5分钟后自动解禁，在未解禁期间输入正确密码也无法登陆。
在配置文件 /etc/pam.d/sshd 顶端加入
auth required pam_tally2.so deny=3 onerr=fail unlock_time=300
查看失败次数
# pam_tally2 Login Failures Latest failure From root 14 07/12/13 15:44:37 192.168.6.2 neo 8 07/12/13 15:45:36 192.168.6.2
重置计数器
# pam_tally2 -r -u root Login Failures Latest failure From root 14 07/12/13 15:44:37 192.168.6.2 # pam_tally2 -r -u neo Login Failures Latest failure From neo 8 07/12/13 15:45:36 192.168.6.2
pam_tally2 计数器日志保存在 /var/log/tallylog 注意，这是二进制格式的文件
例 1.1. /etc/pam.d/sshd - pam_tally2.so
# cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_tally2.so deny=3 onerr=fail unlock_time=300 auth required pam_sepermit.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional pam_keyinit.so force revoke session include password-auth
以上配置root用户不受限制, 如果需要限制root用户，参考下面
auth required pam_tally2.so deny=3 unlock_time=5 even_deny_root root_unlock_time=1800
将下面一行添加到 /etc/pam.d/sshd 中，这里采用白名单方式，你也可以采用黑名单方式
auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=fail
将允许登陆的用户添加到 /etc/ssh/whitelist，除此之外的用户将不能通过ssh登陆到你的系统
# cat /etc/ssh/whitelist neo www
例 1.2. /etc/pam.d/sshd - pam_listfile.so
# cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=fail auth required pam_tally2.so deny=3 onerr=fail unlock_time=300 auth required pam_sepermit.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional pam_keyinit.so force revoke session include password-auth
sense=allow 白名单方式, sense=deny 黑名单方式
auth required pam_listfile.so item=user sense=deny file=/etc/ssh/blacklist onerr=fail
更多细节请查看手册 $ man pam_listfile
编辑 /etc/pam.d/sshd 文件，加入下面一行
account required pam_access.so
保存后重启sshd进程
编辑 /etc/security/access.conf 文件
cat >> /etc/security/access.conf << EOF - : root : ALL EXCEPT 192.168.6.1 EOF
只能通过 192.168.6.1 登陆, 添加多个IP地址
- : root : ALL EXCEPT 192.168.6.1 192.168.6.2
测试是否生效
限制普通用户通过su命令提升权限至root. 只有属于wheel组的用户允许通过su切换到root用户
编辑 /etc/pam.d/su 文件，去掉下面的注释
auth required pam_wheel.so use_uid
修改用户组别，添加到wheel组
# usermod -G wheel www # id www uid=501(www) gid=501(www) groups=501(www),10(wheel)
没有加入到wheel组的用户使用su时会提示密码不正确。
$ su - root Password: su: incorrect password