<html><body><div>Hi all,</div><div><br></div><div>I believe I have accomplished my goal, I'm just wanting to verify with the list that this is the right way to get what I want. Our configuration is as follows.</div><div><br></div><div>1. RHEL 6 with some local accounts.</div><div>2. We are using sssd to authenticate to Active Directory for other accounts.</div><div>3. We don't want a faillock table maintained for sssd-authenticated users because AD has its own way to do this.</div><div>4. We _do_ want faillock for local users.</div><div><br></div><div>Our auth section of the system-auth-ac file previously looked like this,</div><div><br></div><div><div>auth required pam_env.so</div><div>auth required pam_faillock.so preauth audit deny=3 unlock_time=900</div><div>auth sufficient pam_fprintd.so</div><div>auth sufficient pam_unix.so try_first_pass</div><div>auth requisite pam_succeed_if.so uid >= 500 quiet</div><div>auth sufficient pam_sss.so use_first_pass</div><div>auth [default=die] pam_faillock.so authfail audit deny=3 unlock_time=900 fail_interval=900</div><div>auth sufficient pam_faillock.so authsucc audit deny=3 unlock_time=900 fail_interval=900</div><div>auth required pam_deny.so</div></div><div><br></div><div>In order to skip the faillock stuff for the AD users, I changed the sssd line to look like this,</div><div><br></div><div><div>auth [success=done new_authtok_reqd=done default=2] pam_sss.so use_first_pass</div></div><div><br></div><div>Can I just confirm that I'm going about this in the correct way? My goal is: the local linux faillock table is used when a local user fails to authenticate, but local table is not used when a sssd-authenticated user fails to authenticate (I'm hoping to let AD handle that).</div><div><pre style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap" data-mce-style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap;">Bryan</pre><pre style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap" data-mce-style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap;"><br></pre></div></body></html>