Linux PAM Hardening: Multi-Factor Auth, Limits, and Lockouts

On Linux systems, all interactive logins, su elevation, and sudo privilege escalation flow through Pluggable Authentication Modules (PAM). Rather than embedding authentication logic into individual programs, PAM delegates authentication, account expiration, session setup, and password rules to stacked shared libraries under /etc/pam.d/.

Default PAM configurations are often surprisingly permissive: they lack automatic account lockouts against brute-force password guessing, fail to enforce hardware or Time-based One-Time Password (TOTP) two-factor authentication, and permit unlimited simultaneous logins that leave servers vulnerable to denial-of-service. Hardening PAM establishes a defense-in-depth barrier at the operating system identity boundary.

Expand

Mitigating Brute Force Attacks with pam_faillock

The pam_faillock module tracks failed authentication attempts in tmpfs (/run/faillock/) and locks accounts automatically when failure thresholds are breached.

Configure global lockout rules in /etc/security/faillock.conf:

# /etc/security/faillock.conf
dir = /run/faillock
audit
silent
deny = 5
fail_interval = 900
unlock_time = 1800
even_deny_root
root_unlock_time = 900

Integrate faillock into the PAM authentication stack by updating /etc/pam.d/common-auth:

# /etc/pam.d/common-auth
auth    required    pam_faillock.so preauth silent
auth    [success=1 default=ignore] pam_unix.so nullok
auth    [default=die] pam_faillock.so authfail
auth    sufficient  pam_faillock.so authsucc

Inspecting and Resetting Locked Accounts

When an administrator or automated attacker exceeds the 5-attempt threshold, inspect and reset locked records using the faillock utility:

# Inspect failed login attempts for user admin
sudo faillock --user admin

# Reset and unlock the account immediately
sudo faillock --user admin --reset

Hardening Resource Limits with pam_limits

Prevent fork-bombs and file descriptor exhaustion by enforcing strict resource limits under /etc/security/limits.d/99-limits.conf:

# /etc/security/limits.d/99-limits.conf
# Enforce maximum open files and process threads for all users
*       soft    nofile    65535
*       hard    nofile    65535
*       soft    nproc     4096
*       hard    nproc     8192
root    soft    nofile    1048576
root    hard    nofile    1048576

Remote Access Hardening Video

Review essential Linux authentication hardening and access controls in this overview:

Enforcing TOTP Two-Factor Authentication

To require a 6-digit TOTP token alongside public-key SSH logins, install the libpam-google-authenticator package, append auth required pam_google_authenticator.so nullok to /etc/pam.d/sshd, and enable KbdInteractiveAuthentication yes in /etc/ssh/sshd_config. This ensures that even if private keys or passwords are leaked, attackers cannot compromise the host without physical access to the authenticator device.

Provision secure, enterprise-grade cloud servers with one click at netbayhosts.in.