How to enforce account lockout policies (copy)

Question

How to enforce account lockout policies (copy)

I use Linux along side with Mac. On Linux I am able to enforce account lockout policies by using pam_tally2. So whenever a password, whether it be logging into the computer or inputing the password for sudo, is incorrect X times, I will have to wait X amount of time to input the password again. I want to impletment this on my Mac. Mac does have a pam tally directory called `/etc/pam.d`, so I think it is possible to use pam_tally2. My question is, can I use pam_tally2 to enforce account lockout policies on my Mac? If not, is there a different way of enforcing account lockout policies?

(Note: This is a copy of a post I had already made. I made a copy because my other post was not getting any attention. I thought I may get some answers choosing a different community to post this in)

Mac mini, macOS High Sierra (10.13.3), null

Posted on Feb 10, 2018 8:01 PM

Reply

Answer 1

Barney-15E

Level 10

122,690 points

Feb 10, 2018 8:36 PM in response to Strange Ranger

I can't help, but you should not assume that Linux is the same as Unix, and you should not assume that even though there are Unix underpinnings in macOS that they are implemented in any way similar to Unix or Linux.

This is quite old, so not sure if it is still an option: How to set up password policies in OS X - CNET

While there may be a way to configure it in the client, the only thing I found was using Profile Manager in the Server app to configure profiles. You can see what options are available for passwords in this screencast: macOS Sierra Server Part 26: Profile Manager Users & Groups - YouTube Password stuff starts around 4:00.

Reply

Answer 2

Kappy

Level 10

362,017 points

Feb 10, 2018 8:27 PM in response to Strange Ranger

Your question is about OS X software, not Desktop Computers. That would make this the wrong community. The command, pam_tally2, does not exist on my system. To use it would mean finding the source and compiling it on the Mac or finding it via MacPorts, perhaps.

Reply