First, I am a relative Linux newbie, so bear with me.
Much of the advice I have found on the web for limiting login attempts does not pertain to Quantal. All of it does specify using pam_tally.so
or pam_tally2.so
, which seem to be the fundamental Linux mechanisms for user authentication. Unfortunately, it also appears that various distros (RHEL, Ubuntu, Cent, etc.) have slight variations for configuration requirements.
In 12.10, after enabling pam_tally.so
, the main problems I have encountered are related to incorrect tally incrementing:
- increments 2 times for every login failure
- increments all other users when a user fails
- increments all other when a user switches accounts
And other variations of this behavior. However, it does lock accounts that exceed the limit, as required, and resets the counter to 0 after a successful login.
pam_tally2.so
eliminates some of the errors, such as incrementing all other users when a different user fails, but still increments the user 2 times for every failure.
Here is what my /etc/pam.d/common-auth
looks like:
auth required pam_tally2.so file=/var/log/tallylog deny=3
auth [success=1 default=ignore] pam_unix.so
account required pam_tally2.so
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so
If I duplicate the instructions on manpages for pam_tally2.so
, I am locked out of the machine and have to undo the changes via root from a LiveCD boot.
My questions are:
- Is
pam_tally.so
now fully deprecated in favor ofpam_tally2.so
? - Does anyone have a working common-auth file they can post, which works exactly as advertised, for 12.10? Any other suggestions are welcome as well.
- Does 13.04 use a different mechanism than pam_tally to manage login counts & lockouts?
If 13.04 does limit logins correctly, with less hassle than 12.10, I would probably migrate to it since limiting login attempts is a necessary feature for this machine. If login attempts cannot be limited in some version of Ubuntu, I will likely have to use another distro, like CentOS.