security audits: failed login

[WolfmanJ]

The default for failed login attempts before a log entry is made is 5 failures. Our security auditors want this knocked down to 3 consecutive attempts. Is there an override for the default that can be put in /etc/system?

 

[jfk]

It's not well documented but add the variable:<br>
<br>
RETRIES=3<br>
<br>
to your /etc/default/login file.<br>
<br>
That should do the trick.<br>
<br>
jfk

 

[jfk]

Doh! Sorry, I wasn't thinking this through. The above variable works when you have the PAM (Pluggable Authentication Module) in place. This package is available for Solaris 2.6+.<br>
<br>
jfk

 

[WolfmanJ]

Thanks. Will keep the PAM in mind when we move up to 2.6. However, we are still running Solaris 2.5.1