I'm not sure if this issue is with pam_tally2
itself or with Ubuntu which is what I'm trying to find out. pam_tally2
for some reason is having issues on 14 and 16. My /etc/pam.d/common-auth
file looks as follows:
auth required pam_env.so
auth required pam_tally2.so deny=5 unlock_time=900 onerr=fail
auth [success=1 default=ignore] pam_unix.so nullok_secure
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so
The first two lines I inserted manually based on previous forums and the man page. (For testing purposes I changed deny
to =3
and unlock_time
to =20
so as not to take so long testing).
- After doing so, nothing seems to take effect until I reboot the machine which is unlike pam where usually changes to pam take effect immediately.
- After rebooting and intentionally failing password input 3 times I am successfully locked out for 20 seconds however I notice the counter says I failed 4 times even though it's only 3. Also taking note, when inputting the wrong password, the usual message displayed is
Invalid password, please try again
, in red text and once the system is locked out, the messageAccount locked due to 4 failed logins, appears in white text
. - After waiting 20 seconds and inputting the correct password, it still fails me one more time before changing the fail text to the original red text but then unlocking after I put the password in correctly yet again. Furthermore, the account lockout only seems to work on the first login after the system reboot. If I login correctly that once or intentionally fail logging in, afterwards, I will be able to login no matter how many times I fail.
Some forums and blogs say that you also need to put:
account required pam_tally2.so
inside the common-account
file also
Other forums say to put the the aforementioned line but with all the options that you put in the common-auth
file too. Neither of these approaches seem to make pam_tally2 work.
I've also tried experimentally to put
account required pam_env.so
inside the common-account
file as the first line. This doesn't seem to work or change anything either.
I've tried putting the pam_env.so
line above and below the pam_tally2.so
in both files in all possible combinations and this doesn't seem to correct the behavior.
If anyone knows why pam_tally2.so
isn't working or if it's a bug with Ubuntu please let me know. Thank you for your time.