Pam abl

From Hexten

pam_abl provides auto blacklisting of hosts and users responsible for repeated failed authentication attempts. Generally configured so that blacklisted users still see normal login prompts but are guaranteed to fail to authenticate.

Brute force password discovery attacks involve repeated attempts to authenticate against a service using a dictionary of common passwords. While it is desirable to enforce strong passwords for users this is not always possible and in cases where a weak password has been used brute force attacks can be effective.

The pam_abl module monitors failed authentication attempts and automatically blacklists those hosts (and accounts) that are responsible for large numbers of failed attempts. Once a host is blacklisted it is guaranteed to fail authentication even if the correct credentials are provided.

Blacklisting is triggered when the number of failed authentication attempts in a particular period of time exceeds a predefined limit. Hosts which stop attempting to authenticate will, after a period of time, be un-blacklisted.

Contents 1 Volunteer! 2 Download 3 Install 4 Documentation 5 Bugs

[edit] Volunteer!

I'm actively seeking someone to take over maintenance of pam_abl. I don't really have time to do it justice. If you'd like to volunteer please mail me: andyAThextenDOTnet.

[edit] Download

http://sourceforge.net/project/showfiles.php?group_id=148927

[edit] Install

Until I find time to do something nice with autoconf building the module is a question of editing the makefiles in distribution directory and the tools subdirectory so they match the paths on your system and then doing

Edit your PAM configuration to include the pam_abl.so module. Here's an example

[edit] Documentation

The documentation is included in the archive and is also available here.

[edit] Bugs

If you find one please report it here.