From 9524259765fc676f55b4b2b505bb1ab0b268ea25 Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Tue, 25 Nov 2025 15:03:41 +0100 Subject: [PATCH] Ensure lockout limit is reset on restart --- install/config/increase-lockout-limit.sh | 4 ++++ migrations/1764067963.sh | 4 ++++ 2 files changed, 8 insertions(+) create mode 100644 migrations/1764067963.sh diff --git a/install/config/increase-lockout-limit.sh b/install/config/increase-lockout-limit.sh index 522deb72..5932906f 100644 --- a/install/config/increase-lockout-limit.sh +++ b/install/config/increase-lockout-limit.sh @@ -1,3 +1,7 @@ # Increase lockout limit to 10 and decrease timeout to 2 minutes sudo sed -i 's|^\(auth\s\+required\s\+pam_faillock.so\)\s\+preauth.*$|\1 preauth silent deny=10 unlock_time=120|' "/etc/pam.d/system-auth" sudo sed -i 's|^\(auth\s\+\[default=die\]\s\+pam_faillock.so\)\s\+authfail.*$|\1 authfail deny=10 unlock_time=120|' "/etc/pam.d/system-auth" + +# Ensure lockout limit is reset on restart +sudo sed -i '/pam_faillock\.so preauth/d' /etc/pam.d/sddm-autologin +sudo sed -i '/auth.*pam_permit\.so/a auth required pam_faillock.so authsucc' /etc/pam.d/sddm-autologin diff --git a/migrations/1764067963.sh b/migrations/1764067963.sh new file mode 100644 index 00000000..99590cbb --- /dev/null +++ b/migrations/1764067963.sh @@ -0,0 +1,4 @@ +echo "Ensure lockout limit is reset on reboot" + +sudo sed -i '/pam_faillock\.so preauth/d' /etc/pam.d/sddm-autologin +sudo sed -i '/auth.*pam_permit\.so/a auth required pam_faillock.so authsucc' /etc/pam.d/sddm-autologin