To configure the vRealize Operations appliances and the Cloud Proxy appliances account lockout policy for the local account, decide on certain policy settings.

Table 1. Default Account Lockout Policy for vRealize Operations

Setting

Default

Description

deny

3

Maximum number of authentication failures before the account is locked

unlock_time

900

Amount of time in seconds that the account remains locked

root_unlock_time

900

Amount of time in seconds that the root account remains locked

Procedure

  1. Log in to the primary vRealize Operations node by using a Secure Shell (SSH) client at <vrealize_operations_primary_node_fqdn> as root.
  2. Back up the /etc/pam.d/system-auth file for the appliance by running the following command.
    cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth-`date +%F_%H:%M:%S`.back
  3. Configure the maximum number of failed log-in attempts.
    sed -i -E 's/deny=[-]?[0-9]+/deny=<your_value>/g' /etc/pam.d/system-auth
  4. Configure the unlock time for the root account.
    sed -i -E 's/root_unlock_time=[-]?[0-9]+/root_unlock_time=<your_value>/g' /etc/pam.d/system-auth
  5. Configure the unlock time for all other local accounts.
    sed -i -E 's/unlock_time=[-]?[0-9]+/unlock_time=<your_value>/g' /etc/pam.d/system-auth
  6. Verify the values.
    cat /etc/pam.d/system-auth

  7. Repeat the procedure for the remaining vRealize Operations appliances and the Cloud Proxy appliances.