Setting up a Raspberry Pi 4 home server

Re:Setting up a Raspberry Pi 4 home server by tyingq on Thursday February 20, 2020 @10:02AM (#22375501)

I like pam_shield better than fail2ban. It's directly inline with auth, versus parsing logs, and is easier to customize for any oddball setup you might want.

There's also a similar pam module called pam_tally2, which I haven't used.

[ Parent | on HN ]

Re:Setting up a Raspberry Pi 4 home server by jlgaddis on Thursday February 20, 2020 @05:35PM (#22379276)

I'm not familiar with pam_shield but I've used the pam_faillock module (which is similar to pam_tally2) for years and it just works(TM) [0].

In fact, here, it's automatically configured on each and every host at install-time (via the post-installation scripts in my kickstart files). I can't remember a time when I ever needed to "touch" it afterwards.

(A few years ago, I evaluated pam_tally2 vs. pam_faillock and settled on pam_faillock but, unfortunately, I can't recall what led me to that choice.)

---

[0]: In reality, though, it doesn't really do much. There's only two Internet-facing servers with 22/TCP open to the world -- the bastion hosts -- and only public-key authentication is permitted on those.

[ Parent | on HN ]