Why should administrator or superuser account never locked regardless how many incorrect login attempts are made?
What should be done instead to alert the staff to the attempted instrusion?
2
-
1Superuser should never be locked because an attacker trying to break in would result in locking himself out as well as the actual superuser/administrator who should not be denied access? – superfloyd Apr 25 '12 at 19:31
5
Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect.
I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in.
To prevent from locking yourself out you can whitelist some IP's that will never get blocked.
answered Apr 25 '12 at 19:18
3
Superuser on Unix/Linux aka. root shouldn't have a password in the first place or only be accepted from the physical console. Exactly for this reason. It is bad practice logging in as root, it is better to log in as a regular user and then sudo to root.
