Re:Setting up a Raspberry Pi 4 home server
by jlgaddis on Thursday February 20, 2020 @05:35PM
(#22379276)
I'm not familiar with pam_shield but I've used the pam_faillock module (which is similar to pam_tally2) for years and it just works(TM) [0].
In fact, here, it's automatically configured on each and every host at install-time (via the post-installation scripts in my kickstart files). I can't remember a time when I ever needed to "touch" it afterwards.
(A few years ago, I evaluated pam_tally2 vs. pam_faillock and settled on pam_faillock but, unfortunately, I can't recall what led me to that choice.)
---
[0]: In reality, though, it doesn't really do much. There's only two Internet-facing servers with 22/TCP open to the world -- the bastion hosts -- and only public-key authentication is permitted on those.
In fact, here, it's automatically configured on each and every host at install-time (via the post-installation scripts in my kickstart files). I can't remember a time when I ever needed to "touch" it afterwards.
(A few years ago, I evaluated pam_tally2 vs. pam_faillock and settled on pam_faillock but, unfortunately, I can't recall what led me to that choice.)
---
[0]: In reality, though, it doesn't really do much. There's only two Internet-facing servers with 22/TCP open to the world -- the bastion hosts -- and only public-key authentication is permitted on those.