pam_tally2 module is available in RHEL and CentOS and it can be used to protect your system against bruteforce attacks.
Enabling pam_tally2
Edit /etc/pam.d/password-auth and add this line on top of the auth lines:
auth required pam_tally2.so onerr=fail deny=3 unlock_time=900
Then add following line on top of the account lines:
account required pam_tally2.so
Parameters to this module are simple:
onerr=fail
If something weird happens (like unable to open the file), return with PAM_SUCCESS if onerr=succeed is given, else with the corresponding PAM error code.
deny=3
Deny access if tally for this user exceeds 3 times.
unlock_time=900
Allow access after 900 seconds (15 minutes) after failed attempt. If this option is used the user will be locked out for the specified amount of time after he exceeded his maximum allowed attempts. If this option is not set administrator will need to unlock user's account manually.
Check if you have following options set in /etc/ssh/sshd_config:
UsePAM yes
ChallengeResponseAuthentication yes
Testing pam_tally2
login as: pajarito
Using keyboard-interactive authentication.
Password:
Access denied
Using keyboard-interactive authentication.
Password:
Access denied
Using keyboard-interactive authentication.
Password:
Access denied
Using keyboard-interactive authentication.
Account locked due to 3 failed logins
Password:
As you can see after third attempt user's account was locked.
Verifying and unlocking users
To check current pam_tally2 statistics run pam_tally2 command:
# pam_tally2
Login Failures Latest failure From
jsmith 3 09/09/15 15:17:21 evil.attacker.com
To unlock a user use the "-r" flag:
# pam_tally2 -u pajarito -r
Login Failures Latest failure From
jsmith 3 09/09/15 15:20:49 evil.attacker.com
Finally if the output of pam_tally2 is empty it means that no account has been locked.
NIS SERVER SETUP:
1. Install required packages:
# yum install ypserv portmap
2. Edit /etc/sysconfig/network and add static NIS ports:
YPSERV_ARGS="-p 841"
YPPASSWDD_ARGS="-p 842"
YPXFRD_ARGS="-p 843"
To verify currently used ports run:
# rpcinfo -p localhost
3. Open required ports in firewall. Edit /etc/sysconfig/iptables and add:
-A RH-Firewall-1-INPUT -p udp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp --dport 841 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 841 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp --dport 842 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 842 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp --dport 843 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 843 -j ACCEPT
# service iptables restart
4. Setup NIS domain name - edit /etc/sysconfig/network and add:
NISDOMAIN="internal"
5. Initialize NIS maps:
/usr/lib/yp/ypinit -m
6. Secure NIS - permit only trusted networks. You may allow only specified subnets using iptables (i.e. by adding -s 192.168.0.0/24 to the portmap and NIS ports) or by editing /var/yp/securenets and including permitted networks in following format:
255.255.255.0 192.168.0.0
7. Start services and include them in rc3.d scripts:
# service portmap start
# service ypserv start
# chkconfig portmap on
# chkconfig ypserv on
You may include yppasswdd and ypxfrd as well if you need them.
UPDATING NIS MAPS:
# cd /var/yp; make
NIS CLIENT SETUP:
Execute:
# authconfig --update --nisdomain=internal --nisserver=nis.example.com --enablenis
Or:
# authconfig-tui
Finally make sure that ypbind is running and it's added to rc3.d services:
# service ypbind start
# chkconfig ypbind on
VIEWING NIS MAPS:
On the client:
# getent <mapname>
# getent passwd
On any allowed host:
# ypcat -d internal -h nis.example.com <mapname>
# ypcat -d internal -h nis.example.com passwd
Default settings for NICs is good for most cases however there are times when you need to do some performance tuning.
When you start to observe increasing drops of RX packets it means that your system cannot process incoming packets fast enough. You can verify on your monitoring system to correlate this issue with increased network traffic at the same time.
# ifconfig
eth0 Link encap:Ethernet HWaddr 00:22:19:50:ea:76
inet addr:192.168.x.x Bcast:192.168.x.x Mask:255.255.xxx.xxx
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3208932 errors:0 dropped:19188 overruns:0 frame:0
TX packets:1543138 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
First verify current NIC settings:
# ethtool -g eth0
Ring parameters for eth0:
Pre-set maximums:
RX: 1020
RX Mini: 0
RX Jumbo: 4080
TX: 255
Current hardware settings:
RX: 255
RX Mini: 0
RX Jumbo: 0
TX: 255
Increasing ring buffer for rx should fix this issue:
# ethtool -G eth0 rx 512
To have this settings persistent make sure you add this command to /etc/rc.local script.
