Securing Logins and Passwords (Tasks)

You can limit remote logins, require users to have passwords, and require the root account to have a complex password. You can also monitor failed access attempts and disable logins temporarily.

Securing Logins and Passwords (Task Map)

The following task map points to procedures that monitor user logins and that disable user logins.

How to Change the root Password

When you change the root password, you must comply with the password requirements that apply to all users of the system.

Before You Begin

You must be in the root role.

• Change your password.

  # passwd root
  New Password:
  Re-enter new Password:
  passwd: password successfully changed for root

  A message prints to the screen if your password does not conform to requirements. The messages are informative. After three attempts, you must run the command again to change the password.

  passwd: Password too short - must be at least 6 characters.
  passwd: The password must contain at least 2 alphabetic character(s).
  passwd: The password must contain at least 1 numeric or special character(s).

How to Display a User's Login Status

Before You Begin

You must be in the root role.

• Display a user's login status by using the logins command.

  # logins -x -l username

  -x

  Displays an extended set of login status information.

  -l username

  Displays the login status for the specified user. The variable username is a user's login name. Multiple login names are separated by commas.

  The logins command uses the appropriate password database to obtain a user's login status. The database can be the local /etc/passwd file, or a password database for the naming service. For more information, see the logins(1M) man page.

Example 3-1 Displaying a User's Login Status

In the following example, the login status for the user jdoe is displayed.

# logins -x -l jdoe
jdoe       500     staff           10   Jaylee Jaye Doe
                   /home/jdoe
                   /bin/bash
                   PS 010103 10 7 -1

jdoe

Identifies the user's login name.

500

Identifies the user ID (UID).

staff

Identifies the user's primary group.

10

Identifies the group ID (GID).

Jaylee Jaye Doe

Identifies the comment.

/home/jdoe

Identifies the user's home directory.

/bin/bash

Identifies the login shell.

PS 010170 10 7 -1

Specifies the password aging information:

• Last date that the password was changed

• Number of days that are required between changes

• Number of days before a change is required

• Warning period

How to Display Users Without Passwords

Before You Begin

You must be in the root role.

• Display all users who have no passwords by using the logins command.

  # logins -p

  The -p option displays a list of users with no passwords. The logins command uses the passwd database from the local system unless a distributed naming service is specified in the nsswitch.conf file.

Example 3-2 Displaying Users Without Passwords

In the following example, the user pmorph does not have a password.

# logins -p
pmorph          501     other           1       Polly Morph
# 

How to Temporarily Disable User Logins

Temporarily disable user logins during system shutdown or routine maintenance. Superuser logins are not affected. For more information, see the nologin(4) man page.

Before You Begin

You must be in the root role.

1. Create the /etc/nologin file in a text editor.

   # vi /etc/nologin

2. Include a message about system availability.
3. Close and save the file.

Example 3-3 Disabling User Logins

In this example, users are notified of system unavailability.

# vi /etc/nologin
(Add system message here)
 
# cat /etc/nologin 
***No logins permitted.***

***The system will be unavailable until 12 noon.***

You can also bring the system to run level 0, single-user mode, to disable logins. For information about bringing the system to single-user mode, see Chapter 3, Shutting Down a System (Tasks), in Booting and Shutting Down Oracle Solaris on x86 Platforms.

How to Monitor Failed Login Attempts

This procedure captures failed login attempts from terminal windows. This procedure does not capture failed logins from a desktop login attempt.

Before You Begin

You must be in the root role.

1. Create the loginlog file in the /var/adm directory.

   # touch /var/adm/loginlog

2. Set read-write permissions for root user on the loginlog file.

   # chmod 600 /var/adm/loginlog

3. Change group membership to sys on the loginlog file.

   # chgrp sys /var/adm/loginlog

4. Verify that the log works.

   For example, log in to the system five times with the wrong password. Then, display the /var/adm/loginlog file.

   # more /var/adm/loginlog
   jdoe:/dev/pts/2:Tue Nov  4 10:21:10 2010
   jdoe:/dev/pts/2:Tue Nov  4 10:21:21 2010
   jdoe:/dev/pts/2:Tue Nov  4 10:21:30 2010
   jdoe:/dev/pts/2:Tue Nov  4 10:21:40 2010
   jdoe:/dev/pts/2:Tue Nov  4 10:21:49 2010
   #

   The loginlog file contains one entry for each failed attempt. Each entry contains the user's login name, tty device, and time of the failed attempt. If a person makes fewer than five unsuccessful attempts, no failed attempts are logged.

   A growing loginlog file can indicate an attempt to break into the computer system. Therefore, check and clear the contents of this file regularly. For more information, see the loginlog(4) man page.

How to Monitor All Failed Login Attempts

This procedure captures in a syslog file all failed login attempts.

Before You Begin

You must be in the root role.

1. Set up the /etc/default/login file with the desired values for SYSLOG and SYSLOG_FAILED_LOGINS

   Edit the /etc/default/login file to change the entry. Make sure that SYSLOG=YES is uncommented.

   # grep SYSLOG /etc/default/login
   # SYSLOG determines whether the syslog(3) LOG_AUTH facility should be used
   SYSLOG=YES
   # The SYSLOG_FAILED_LOGINS variable is used to determine how many failed
   #SYSLOG_FAILED_LOGINS=5
   SYSLOG_FAILED_LOGINS=0
   #

2. Create a file with the correct permissions to hold the logging information.
   1. Create the authlog file in the /var/adm directory.

      # touch /var/adm/authlog

   2. Set read-and-write permissions for root user on the authlog file.

      # chmod 600 /var/adm/authlog

   3. Change group membership to sys on the authlog file.

      # chgrp sys /var/adm/authlog

3. Edit the syslog.conf file to log failed password attempts.

   Send the failures to the authlog file.

   1. Type the following entry into the syslog.conf file.

      Fields on the same line in syslog.conf are separated by tabs.

      auth.notice <Press Tab>  /var/adm/authlog

   2. Refresh the system-log service.

      # svcadm refresh system/system-log

4. Verify that the log works.

   For example, as an regular user, log in to the system with the wrong password. Then, as superuser, display the /var/adm/authlog file.

   # more /var/adm/authlog
   Nov  4 14:46:11 example1 login: [ID 143248 auth.notice] 
    Login failure on /dev/pts/8 from example2, stacey
   #

5. Monitor the /var/adm/authlog file on a regular basis.

Example 3-4 Logging Access Attempts After Three Login Failures

Follow the preceding procedure, except set the value of SYSLOG_FAILED_LOGINS to 3 in the /etc/default/login file.

Example 3-5 Closing Connection After Three Login Failures

Uncomment the RETRIES entry in the /etc/default/login file, then set the value of RETRIES to 3. Your edits take effect immediately. After three login retries in one session, the system closes the connection.