How do I set up pam_faillock?

Question

I very recently installed an Ubuntu VM to play with and decided I wanted to get a better understanding of faillock. I read the man pages for faillock and pam_faillock and felt like I followed the instructions, but based on my results I must have missed something.

I am running Ubuntu 20.04.4 LTS. These are the config file changes I made (based on the man pages)

$ grep -v '#' /etc/security/faillock.conf
dir = /var/run/faillock
audit
silent
deny = 3
fail_interval = 900
unlock_time = 120

$ grep faillock /etc/pam.d/login
auth    required    pam_faillock.so preauth
auth    [default=die]   pam_faillock.so authfail
account required    pam_faillock.so

$ sudo faillock
faillock: Error reading tally directory: No such file or directory

Obviously I can create the tally directory. But I imagine that if I had done everything properly - something would have created it for me.

I went ahead just now and created it. I ssh'd to the host with a test account, and used a bad password 6 times, but it did not seem to do anything. The account did not get locked, and running faillock now outputs nothing.

I saw some mention in the pam.d config files of pam-auth-update. On a hunch, I went ahead and ran that just in case it is something that should be run when you update things in pam.d config files. But it did not seem to do anything useful.

Any ideas what I have missed? Thanks in advance.

---- updates

I touched a file for a user named the_dude and set its permissions to rw for the user.

$ ls -l /var/run/faillock/the_dude

When I ran sudo faillock --user the_dude , it outputs the basic heading now.

$ sudo faillock --user the_dude
the_dude:
When                Type  Source                                           Valid

I notice though, that when I create some bad login attempts, that nothing is placed into the tally file.

Also, I rebooted the VM and found that some process went through and removed the tally files and directory.

So I believe I am missing a step somewhere that 'enables' this module - but I don't see anything in the man pages that says that anything like that is needed.

If it did not like something that was in my config, where would it dump log messages about it?

Answer 1

I haven't tested this on Ubuntu 20.04, but the following appears to be working on Ubuntu 22.04. PAM tally has been removed in 22.04.

Make sure you have a root shell open when making these changes and test with another user so you can still revert the changes if it breaks authentication.

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    required pam_faillock.so preauth audit silent deny=5 unlock_time=900
auth    [success=1 default=ignore]      pam_unix.so nullok
# here's the fallback if no module succeeds
# BEGIN ANSIBLE MANAGED BLOCK
auth    [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
auth    sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
# END ANSIBLE MANAGED BLOCK
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                        pam_cap.so
# end of pam-auth-update config

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#

# here are the per-package modules (the "Primary" block)
account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so
# here's the fallback if no module succeeds
account requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
account    required pam_faillock.so