# Alloy brute-force policy.
#
# Replaces the stock pam faillock.conf, which ships every option commented
# out and therefore states nothing. The numbers here are secureblue's, and
# they are deliberately loose: this is a defence against an attacker
# guessing, not against a person mistyping.
#
# The PAM stack that reads this is turned on by
# `authselect enable-feature with-faillock` in the Containerfile. Without
# that, this file is inert — which is the exact failure this project's
# polkit and fingerprint blocks are asserted against, so it is asserted too.
#
# WHAT IT COSTS: fifty consecutive failures locks the account for a day. A
# person who has genuinely done that has a bigger problem than the lockout,
# and the escape hatch is `faillock --user <name> --reset` as root, from
# another session or a VT.
#
# WHAT IT DOES NOT COVER: ssh, because sshd on Alloy takes keys only
# (etc/ssh/sshd_config.d/10-alloy.conf). There is no password to guess over
# the network. This is about the console, the greeter and the lock screen.

# Fifty attempts before the door closes.
deny = 50

# Twenty-four hours, then it opens on its own. `unlock_time = 0` would mean
# root-only recovery, which on a single-user laptop is how you brick your own
# machine.
unlock_time = 86400

# Failures on the root account count too. Off by default; a root console
# login is exactly the thing worth rate-limiting.
even_deny_root
root_unlock_time = 900

# Count failures in a rolling fifteen-minute window rather than forever.
fail_interval = 900

# Say how many attempts are left. Telling an attacker is worth less than a
# person understanding why their next attempt is about to lock them out.
audit