File: //opt/BCLinux/bse/secure_set/s04_loginLock
#!/bin/sh
#=======================================================
rhel67_set_deny(){
if [ ${OS_DISTRO} == "7" -o ${OS_DISTRO} == "6" ]; then
InsertSection "Set user deny time and unlock time"
if [ $LOCK_ATTACKING_USER -eq 1 ]; then
cp -np /etc/pam.d/system-auth /etc/pam.d/system-auth_bak
cp -np /etc/pam.d/sshd /etc/pam.d/sshd_bak
#LINE_NUMEBER=`grep -n pam_* /etc/pam.d/system-auth | grep -w auth | head -n 1 | awk -F : '{printf $1}'`
#LINE_NUMEBER=`expr $LINE_NUMEBER`
IS_EXIST=`grep auth /etc/pam.d/system-auth | grep -v "^#" |grep pam_tally2.so |wc -l`
#echo -e "make sure this file has (deny < 6)"
if [ "${IS_EXIST}" != "0" ] ; then
#echo -e "no auth pam_tall2.so model, adding...."
IS_EXIST=`grep auth /etc/pam.d/system-auth |grep -v "^#" | grep pam_tally2.so | grep deny | wc -l`
if [ "${IS_EXIST}" != "0" ] ; then
sed -i 's/\(^auth.*pam_tally2.so.*\)deny=.*\(onerr.*\)/\1 deny='$DENY_TIMES' \2/' /etc/pam.d/system-auth
else
sed -i "/auth.*pam_tally2.so/d" /etc/pam.d/system-auth
sed -i "/auth.*pam_env.so/i\auth required pam_tally2.so deny=$DENY_TIMES onerr=fail unlock_time=$UNLOCK_TIME" /etc/pam.d/system-auth
fi
#else
IS_EXIST=`grep auth /etc/pam.d/system-auth |grep -v "^#" | grep pam_tally2.so | grep unlock_time | wc -l`
if [ "${IS_EXIST}" != "0" ] ; then
sed -i "s/\(^auth.*pam_tally2.so.*\) unlock_time=.*/\1 unlock_time=$UNLOCK_TIME/" /etc/pam.d/system-auth
else
sed -i "/auth.*pam_tally2.so/d" /etc/pam.d/system-auth
sed -i "/auth.*pam_env.so/i\auth required pam_tally2.so deny=$DENY_TIMES onerr=fail unlock_time=$UNLOCK_TIME" /etc/pam.d/system-auth
fi
#echo -e "exist auth pam_tall2.so model, passing..."
else
sed -i "/auth.*pam_env.so/i\auth required pam_tally2.so deny=$DENY_TIMES onerr=fail unlock_time=$UNLOCK_TIME" /etc/pam.d/system-auth
fi
#set root login lock deny
IS_EXIST2=`grep auth /etc/pam.d/sshd | grep -v "^#" | grep pam_tally2.so | wc -l`
if [ "${IS_EXIST2}" != "0" ] ;then
#if current setting isn't match ${PROFILE} config settings, then change.
IS_EXIST2=`cat /etc/pam.d/sshd | grep -v "^#" | grep -w deny=$DENY_TIMES |grep "onerr=fail"|grep -w unlock_time=$UNLOCK_TIME |grep "even_deny_root" |grep -w root_unlock_time=$ROOT_UNLOCK_TIME| wc -l`
if [ "${IS_EXIST2}" = "0" ] ; then
sed -i "/auth.*pam_tally2.so/d" /etc/pam.d/sshd
sed -i "/auth.*pam_sepermit.so/i\auth required pam_tally2.so deny=$DENY_TIMES onerr=fail unlock_time=$UNLOCK_TIME even_deny_root root_unlock_time=$ROOT_UNLOCK_TIME" /etc/pam.d/sshd
fi
else
sed -i "/auth.*pam_sepermit.so/i\auth required pam_tally2.so deny=$DENY_TIMES onerr=fail unlock_time=$UNLOCK_TIME even_deny_root root_unlock_time=$ROOT_UNLOCK_TIME" /etc/pam.d/sshd
fi
count1=`grep -ir auth /etc/pam.d/system-auth |grep -w deny | grep -v "#"|wc -l`
count2=`grep -ir auth /etc/pam.d/sshd |grep -w deny | grep -v "#"|wc -l`
if [ $count1 -ge 1 -a $count2 -ge 1 ];then
grep -ir auth /etc/pam.d/system-auth |grep -i "deny=" | grep -v "#" | awk -F "deny=" '{print $2}' | awk -F " " '{print $1}' |while read deny
do
if [[ $deny -le 6 ]];then
grep -ir auth /etc/pam.d/sshd |grep -i "deny=" | grep -v "#" | awk -F "deny=" '{print $2}' | awk -F " " '{print $1}' |while read deny
do
if [[ $deny -le 6 ]];then
logtext "Set the user login lock Deny, checking ok"
Display --indent 2 --text "- Set user login lock... " --result FINISHED --color GREEN
#AddHP 1 1
else
logtext "Set the user login lock Deny failed"
Display --indent 2 --text "- Set user login lock... " --result FAILED --color RED
fi
done
else
logtext "Set the user login lock Deny failed"
Display --indent 2 --text "- Set user login lock... " --result FAILED --color RED
fi
done
else
logtext "Set the user login lock Deny failed"
Display --indent 2 --text "- Set user login lock... " --result FAILED --color RED
fi
else
Display --indent 2 --text "- Skip lock system-attacking-user due to config file... " --result SKIPPING --color YELLOW
fi
fi
}
#----------------------------------------------
dir="/etc/pam.d/"
file=""
sed_i2(){
local a=$1
local b=$2
local file=$3
case "$a" in
auth)
case "$b" in
required)
sed -i "/auth.*required.*pam_env.so/a\auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=120" $dir$file
;;
die)
sed -i "/-auth.*pam_sss.so/a\auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=120" $dir$file
;;
sufficient)
sed -i "/auth.*pam_succeed_if.so/i\auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=120" $dir$file
;;
*)
;;
esac
;;
account)
sed -i "/account.*pam_unix.so/a\account required pam_faillock.so" $dir$file
;;
*)
;;
esac
}
#--------------------------------------------------
sed_d2(){
local a=$1
local b=$2
local file=$3
case "$a" in
auth)
case "$b" in
required)
sed -i "/auth.*required.*pam_faillock.so.*preauth/d" $dir$file
;;
die)
sed -i "/auth.*default=die.*pam_faillock.so/d" $dir$file
;;
sufficient)
sed -i "/auth.*sufficient.*pam_faillock.so/d" $dir$file
;;
*)
;;
esac
;;
account)
case "$b" in
required)
sed -i "/account.*required.*pam_faillock.so/d" $dir$file
;;
*)
;;
esac
;;
*)
;;
esac
}
#-------------------------------------------------------------------------------
faillock_1(){
local file=$1
local para1=$2 #pam_faillock.so
local para2=$3 #auth
local para3=$4 #required
local dir="/etc/pam.d/"
faillock_exist1=`grep $2 $dir$file | grep -v "^#" |grep $3 | grep $4 |wc -l`
if [ "$faillock_exist1" != "0" ];then
#sed_d2 auth required system-auth
sed_d2 $para2 $para3 $file
#sed_i2 auth required system-auth
sed_i2 $para2 $para3 $file
else
#sed_i2 auth required system-auth
sed_i2 $para2 $para3 $file
fi
}
#--------------------------------------------------------------------------
set_deny(){
InsertSection "Set user deny time and unlock time"
if [ $LOCK_ATTACKING_USER -eq 1 ]; then
cp -np /etc/pam.d/system-auth /etc/pam.d/system-auth_bak
cp -np /etc/pam.d/password-auth /etc/pam.d/password-auth_bak
#add pam_faillock.so in system-auth
faillock_1 system-auth pam_faillock.so auth required
faillock_1 system-auth pam_faillock.so auth die
faillock_1 system-auth pam_faillock.so auth sufficient
faillock_1 system-auth pam_faillock.so account required
#add pam_faillock.so in password-auth
faillock_1 password-auth pam_faillock.so auth required
faillock_1 password-auth pam_faillock.so auth die
faillock_1 password-auth pam_faillock.so auth sufficient
faillock_1 password-auth pam_faillock.so account required
logtext "Set the user login lock Deny, checking ok"
Display --indent 2 --text "- Set user login lock... " --result FINISHED --color GREEN
else
#echo "- Skip lock system-attacking-user due to config file... "
Display --indent 2 --text "- Skip lock system-attacking-user due to config file... " --result SKIPPING --color YELLOW
fi
}
#=======================================================
case ${OS_ID} in
"\"centos\"" | "centos" |"CentOS" | "\"CentOS\"" | "\"rhel\"" | "rhel" | "\"redhat\"" | "redhat" | "\"bclinux\"" | "bclinux" | "\"BCLinux\"" | "BCLinux" |"\"openEuler\"")
case ${OS_DISTRO} in
"\"7\"" | "7" | "\"6\"" | "6")
rhel67_set_deny
;;
"20.12" |"\"20.12\"" |"21.10"| "\"21.10\"" | "8" | "\"8\"" | "22.10" | "\"22.10\"" )
set_deny
;;
*)
InsertSection "Set user deny time and unlock time"
logtext "we do not support ${OS_ID}-${OS_DISTRO} at this moment"
Display --indent 2 --text "- We do not support ${OS_ID}-${OS_DISTRO} at this moment... " --result WARNING --color RED
esac
;;
*)
InsertSection "Set user deny time and unlock time"
logtext "we do not support ${OS_ID}-${OS_DISTRO} at this moment"
Display --indent 2 --text "- We do not support ${OS_ID}-${OS_DISTRO} at this moment... " --result WARNING --color RED
esac