2

I'm not sure if this issue is with pam_tally2 itself or with Ubuntu which is what I'm trying to find out. pam_tally2 for some reason is having issues on 14 and 16. My /etc/pam.d/common-auth file looks as follows:

auth      required      pam_env.so
auth      required      pam_tally2.so deny=5 unlock_time=900 onerr=fail
auth      [success=1 default=ignore]   pam_unix.so nullok_secure
auth      requisite     pam_deny.so
auth      required      pam_permit.so 
auth      optional      pam_cap.so

The first two lines I inserted manually based on previous forums and the man page. (For testing purposes I changed deny to =3 and unlock_time to =20 so as not to take so long testing).

  1. After doing so, nothing seems to take effect until I reboot the machine which is unlike pam where usually changes to pam take effect immediately.
  2. After rebooting and intentionally failing password input 3 times I am successfully locked out for 20 seconds however I notice the counter says I failed 4 times even though it's only 3. Also taking note, when inputting the wrong password, the usual message displayed is Invalid password, please try again, in red text and once the system is locked out, the message Account locked due to 4 failed logins, appears in white text.
  3. After waiting 20 seconds and inputting the correct password, it still fails me one more time before changing the fail text to the original red text but then unlocking after I put the password in correctly yet again. Furthermore, the account lockout only seems to work on the first login after the system reboot. If I login correctly that once or intentionally fail logging in, afterwards, I will be able to login no matter how many times I fail.

Some forums and blogs say that you also need to put:

account     required     pam_tally2.so

inside the common-account file also

Other forums say to put the the aforementioned line but with all the options that you put in the common-auth file too. Neither of these approaches seem to make pam_tally2 work.

I've also tried experimentally to put

account     required     pam_env.so

inside the common-account file as the first line. This doesn't seem to work or change anything either.

I've tried putting the pam_env.so line above and below the pam_tally2.so in both files in all possible combinations and this doesn't seem to correct the behavior.

If anyone knows why pam_tally2.so isn't working or if it's a bug with Ubuntu please let me know. Thank you for your time.

Zanna
  • 70,465
liquidoshin
  • 21
  • I have been dealing with similar issues on 16.04 to get this all working. Many answers online are incorrect or incomplete. Here is a link to a good and correct explanation. (https://linux-audit.com/locking-users-after-failed-login-attempts-with-pam_tally2/) I have the lockout working correctly except for the lock screen does not increment the tally. The lock screen is controlled by gnome-screensaver, where the login/switch user screen is controlled by lightdm. Your issue may be similar where the first time after a reboot you are using lightdm, and later attempts are using the lock screen. – Andrew Vian May 11 '17 at 21:14

2 Answers2

1

see Ubuntu_16.04
you need also add line account required pam_tally2.so to /etc/pam.d/common-account

Ather Shu
  • 11
0

I had same experience. And I solve it as below.

  1. vim [/etc/pam.d/login] not the [/etc/pam.d/common-auth]

  2. Add the following lines. auth required pam_tally2.so deny=4 even_deny_root unlock_time=1200

    • deny=4 (lock the account after 4 failed logins)
    • even_deny_root (Root account will be locked as well)
    • unlock_time=1200 (unlocked after 20 minutes)

  3. Reference

    • My Ubuntu : Ubuntu 16.04.5 LTS
    • Command : man pam_tally2
user898055
  • 1
  • Hi. Where in the /etc/pam.d/login file do you put this line? Order is very important in pam and you can't just put it anywhere. Also, in my login file I have the following line: @include common-auth which is an import line that imports my contents from the common-auth file so essentially those contents are already in /etc/pam.d/login – liquidoshin Dec 05 '18 at 17:52