Question

A security baseline requires that local user accounts be temporarily locked after 5 consecutive failed login attempts, with the lockout lasting 15 minutes before automatic reset. On a RHEL 9 system, which approach correctly implements this policy using the modern PAM module?

Accepted Answer

Add 'deny=5 unlock_time=900' to the pam_faillock configuration and enable the faillock lines in /etc/pam.d/system-auth and /etc/pam.d/password-auth

Answer

Add 'deny=5 unlock_time=900' to a pam_tally2 entry in /etc/pam.d/sshd only

Answer

Set 'maxlogins 5' in /etc/security/limits.conf and restart sshd

Answer

Set 'PASS_MAX_DAYS 5' and 'PASS_MIN_DAYS 15' in /etc/login.defs