Auto Account Lockouts in *nix 1

[PcLinuxGuru]

There is a discussion in another forum about account lockouts. From what I have read and heard from both Unix and Linux forums, friends and colleagues it isn't advisable because it could actually be a type of DOS attack. For example I try logging into a server as root a few times and the root account gets locked out or some other daemon accounts or all of them....

I am going to lockout the root account on a test machine and see if there is a way to unlock it... like going to init 1 and try resetting it.

Am I wrong in my thinking or am I misinformed?

 

[SgtB]

Well same goes for NT or 2000. You can't lock out the administrator account (by default). That could totally screw things up, and would open all windows machines to a new DOS attack. Same goes for users running services (daemons). Smack that username around until it locks out, thus making that service unavailable...DOS attack.

Best way to combat this is using strong passwords, and keeping an eye on the logs. See someone brute forcing an account that can't be locked out...ban their IP.

So in one sentence.....
Admin/root accounts or service/daemon related accounts should not have lockout polices applied to them due to possible DOS attacks against that username.

Cool upcoming game! Check it out!

http://www.planetside-universe.com

!

 

[JasonDeckard]

A lockout of root on a POSIX system is not as catastrophic as a lockout of the Admin account on Windows. As you pointed out, you can always boot to single-user mode to recover from a lockout of root. I'm not a Windows expert, but I do not believe there is an easy way to unlock the Admin account in Windows (assuming you made changes that allowed Admin to get locked in the first place).

However, allowing your Admin/root account to be locked out by a remote user is still a pain. Imagine having to boot to runlevel 1 every morning until the attacker got bored with your system (or until he guessed the password!).

I believe a better solution is to disallow remote logins as root, and disable locking out root from too many wrong passwords.