Nicolas Williams wrote: > On Mon, Dec 10, 2007 at 08:32:57PM -0500, Yu, Ming wrote: >> But I am still not clear how to "lock out" account after n-times of >> failed login. >> >> Are you saying there is no way to do it in current version of MIT >> kerberos? > > I'm saying that the MIT and Solaris KDCs do not support that feature. > > BUT, you can write a script to "scrape" (i.e., tail) the KDC log files, > keep a per-principal count of failed logins, and disable principals with > too many consecutive failed logins. > > Doug's comment about /etc/passwd was about how you might lock out an > account that you know you want to lock out, but Doug should really have > told you to either disable the principal[*] or to use the passwd(1) > command with the -l option.
I said we use Windows AD for the KDCs and it does lockout a principal after N attempts, and can unlock them after M minutes too. So this has not been an issue for us. > > [*] Disabling the principal will cause the account to be locked IF AND > ONLY IF Kerberos V is the only way to authenticate the account > (e.g., because the passwd field of the account is "NP", as Doug > suggests). > > -- Douglas E. Engert <[EMAIL PROTECTED]> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
