Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Why should administrator or superuser account never locked regardless how many incorrect login attempts are made?

What should be done instead to alert the staff to the attempted instrusion?

share|improve this question
1  
Superuser should never be locked because an attacker trying to break in would result in locking himself out as well as the actual superuser/administrator who should not be denied access? –  superfloyd Apr 25 '12 at 19:31
add comment

2 Answers

Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect.

I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in.

To prevent from locking yourself out you can whitelist some IP's that will never get blocked.

share|improve this answer
    
thanks very much –  superfloyd Apr 25 '12 at 19:30
add comment

Superuser on Unix/Linux aka. root shouldn't have a password in the first place or only be accepted from the physical console. Exactly for this reason. It is bad practice logging in as root, it is better to log in as a regular user and then sudo to root.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.