In this lab, we will learn how to configure Linux accounts and security policies. Specifically, we will set password requirements, configure account lockout settings, and create a temporary user account that will expire on a pre-determined date.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Set up password requirements on a Linux host.
Set the minimum password length to 12 characters:
- Run the command
sudo nano /etc/pam.d/common-password. - At the end of the first uncommented line (line 25) add
minlen=12, one space aftersha512. - Save the file and exit nano.
Set the maximum password age to 180 days and the minimum password age to 3 days:
- Run the command
sudo nano /etc/login.defs. - Search for
99999(press Ctrl + W to search). - Replace
99999with180. - On the next line down, replace the
0with3. - Save the file and exit nano.
- Run the command
- Configure the account lockout settings on a Linux host.
Configure accounts to lock out after 3 failed logins and remain locked out for 10 minutes. Do not configure the root account to lock out after any amount of failed login attempts.
- Run the command
sudo nano /etc/pam.d/common-auth. - Add a line above the first non-commented line and add the following code:
auth required pam_tally2.so onerr=fail deny=3 unlock_time=600 audit
- Run the command
- Create a temporary user account.
The temporary account name should be
contractor1, and it should expire one week from today.- Run the following command:
sudo adduser contractor1 - Provide a password for the account.
- Run the following command (replace
<YYYY-MM-DD>with the date for one week from today):sudo chage -E "<YYYY-MM-DD>" contractor1 - Verify that the account expiration is correctly configured by running the following command and checking the Account expires date:
sudo chage -l contractor1
- Run the following command:
