ampel/blog
2
0
Fork 0
Code Issues Pull requests Activity

docs/server-os/posts/02-security-improvements.md: update

Browse source 
Remove PAM and set draft false.
This commit is contained in:
Luc Bijl 2025-07-26 20:03:01 +02:00
parent 516eeed792
commit 243eacbd6a
1 changed files with 3 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

40
docs/server-os/posts/02-security-improvements.md
View file

@ -2,7 +2,7 @@
title: Security improvements
slug: security-improvents
date: 2024-08-14
draft: true
draft: false
authors:
- luc
- nils
@ -305,45 +305,11 @@ Improve the security of the system by increasing the entropy with the `jitterent
=== "Gentoo Linux"
``` shell-session
sh# emerge -a jitterentropy-library
sh# emerge -a jitterentropy
```
and make sure that the module gets loaded:
``` shell title="/etc/modules-load.d/entropy.conf"
jitterentropy_rng
```
## PAM
There are a few changes that can be made to improve login protection.
First install PAM through `util-linux-login`:
=== "Alpine Linux"
``` shell-session
sh# apk add util-linux-login
```
=== "Gentoo Linux"
``` shell-session
sh# emerge -a util-linux-login
```
Delays can be a deterent against bruteforcing login attempts. Simply add the following line:
``` shell title="/etc/pam.d/login"
auth optional pam_faildelay.so delay=5000000
```
which will add a 5 second delay between login attempts.
The system can also enforce a stronger hash algorithm for a more secure login protector by editing
``` shell title="/etc/pam.d/base-password"
password required pam_unix.so nullock sha512 shadow rounds=1000000
```
> If an account has already been created then change your password so that it is also secure, with: `passwd <username>`. When creating a password make sure that it is at least 8 characters long.
```