PAM: also_deny_root

[joseph-reynolds]

This extends the account lockout to the root user.
See 5841aed

Note that as configured here, the Redfish AccountService REST APIs to PATCH the
AccountLockoutThreshold and AccountLockoutDuration properties do not apply to
the root user. Changing the values will have no effect on the lockout policy
for root. That is the intention.

Signed-off-by: Joseph Reynolds joseph-reynolds@charter.net

[joseph-reynolds]

Fixes SW478305

[joseph-reynolds]

See also pull/79. This is closer to the traditional solution to this problem. (The problem is how to balance attackers continuously guessing passwords vs allowing legitimate users in.) However, we're looking for a better solution. That's being discussed in the review https://gerrit.openbmc-project.xyz/c/openbmc/meta-phosphor/+/27527
Closing this while waiting for a better solution from upstream OpenBMC. If needed, this can be re-opened and used as-is.

[joseph-reynolds]

Do not merge this as-is. The parameter also_deny_root must be changed to even_deny_root. Read the docs: http://www.linux-pam.org/Linux-PAM-html/sag-pam_tally2.html Note: The pam_tally2 module treats the "root" user specially, and do not lock out root by default.

My original commit message was confusing. Here is another try:

Note that the Redfish AccountService REST APIs to PATCH the
AccountLockoutThreshold and AccountLockoutDuration properties do not apply to
the root user. The root user account is never locked. This patch apples a 300 second account lockout policy to the root user account. There are no APIs for the BMC admin to change the root account lockout policy.