configure login failure handling and login connection timeout policies

On Ubuntu (including Ubuntu on Amazon EC2), PAM is structured differently from RHEL, so system-auth and password-auth do not exist. The supported equivalents are: (1) Account lockout — use pam_faillock by editing /etc/pam.d/common-auth and /etc/pam.d/common-account. Add to common-auth (before pam_unix.so): auth required pam_faillock.so preauth silent deny=3 unlock_time=600 even_deny_root auth [default=die] pam_faillock.so authfail deny=3 unlock_time=600 even_deny_root and to common-account: account required pam_faillock.so (this enforces 3 failures with a 10-minute unlock). (2) Idle session timeout — set TMOUT=600 system-wide by creating /etc/profile.d/timeout.sh with export TMOUT=600; readonly TMOUT (applies to bash shells). (3) Clear shell history on logout — in /etc/profile.d/history.sh set export HISTSIZE=0 HISTFILESIZE=0 and optionally add unset HISTFILE or history -c in /etc/bash.bash_logout. These methods are standard, supported on Ubuntu, and achieve the same controls you listed without using RHEL-specific PAM files.

Hello. You may already be aware, but Amazon Linux is based on the Red Hat family, while Ubuntu provided by AWS belongs to the Debian/Ubuntu family, so the configuration methods are naturally quite different. In addition, security modules continue to evolve as OS versions are upgraded, which means these settings require ongoing review and validation.

As you mentioned, while the goal may be similar to configurations used on Amazon Linux, the equivalent approach on Ubuntu differs in terms of structure and supported mechanisms. Below is the Ubuntu-based configuration approach that aligns with your requirements.

Please note that the latest Ubuntu version currently provided by AWS is Ubuntu 24.04 LTS (Long Term Support). If you are running an older Ubuntu version, the configuration details and supported modules may differ, so it is important to verify the OS version before applying these settings.

1. Login attempt limit (3 failed attempts, 10-minute lockout)" sudo vi /etc/pam.d/common-auth // Add the following lines before pam_unix.so

auth required pam_faillock.so preauth silent deny=3 unlock_time=600 even_deny_root

auth [default=die] pam_faillock.so authfail deny=3 unlock_time=600 even_deny_root

auth sufficient pam_faillock.so authsucc deny=3 unlock_time=600 even_deny_root

2. 600-second idle session timeout sudo vi /etc/profile.d/timeout.sh

TMOUT=600

readonly TMOUT

export TMOUT

3. Disable saving command history after logout sudo vi /etc/profile.d/no-history.sh

export HISTSIZE=0

export HISTFILESIZE=0

unset HISTFILE