Limit User Login Attempts (Ubuntu 12.10, pam_tally.so, pam_tally2.so)

Question

First, I am a relative Linux newbie, so bear with me.

Much of the advice I have found on the web for limiting login attempts does not pertain to Quantal. All of it does specify using pam_tally.so or pam_tally2.so, which seem to be the fundamental Linux mechanisms for user authentication. Unfortunately, it also appears that various distros (RHEL, Ubuntu, Cent, etc.) have slight variations for configuration requirements.

In 12.10, after enabling pam_tally.so, the main problems I have encountered are related to incorrect tally incrementing:

• increments 2 times for every login failure
• increments all other users when a user fails
• increments all other when a user switches accounts

And other variations of this behavior. However, it does lock accounts that exceed the limit, as required, and resets the counter to 0 after a successful login.

pam_tally2.so eliminates some of the errors, such as incrementing all other users when a different user fails, but still increments the user 2 times for every failure.

Here is what my /etc/pam.d/common-auth looks like:

auth    required                    pam_tally2.so  file=/var/log/tallylog deny=3
auth    [success=1 default=ignore]  pam_unix.so
account required            pam_tally2.so
auth    requisite           pam_deny.so
auth    required            pam_permit.so
auth    optional            pam_cap.so 

If I duplicate the instructions on manpages for pam_tally2.so, I am locked out of the machine and have to undo the changes via root from a LiveCD boot.

My questions are:

1. Is pam_tally.so now fully deprecated in favor of pam_tally2.so?
2. Does anyone have a working common-auth file they can post, which works exactly as advertised, for 12.10? Any other suggestions are welcome as well.
3. Does 13.04 use a different mechanism than pam_tally to manage login counts & lockouts?

If 13.04 does limit logins correctly, with less hassle than 12.10, I would probably migrate to it since limiting login attempts is a necessary feature for this machine. If login attempts cannot be limited in some version of Ubuntu, I will likely have to use another distro, like CentOS.

Answer 1

This is from the pam_tally "man" page.

pam_tally has several limitations, which are solved with pam_tally2. For this reason pam_tally is deprecated and will be removed in a future release.

You can view it (and any other command in this format) by entering the following into Terminal:

man pam_tally

Do you intend to implement lockouts at the keyboard and/or over the network (ssh)? I don't have an example for you but below you may 'find the answers you seek.' First you'll need to edit that file you mentioned by entering this from Terminal:

sudo gedit /etc/pam.d/common-auth

Add this at the top of the file (order of rules matters):

auth required pam_tally.so per_user magic_root onerr=fail

This sets the number of allowed attempts

sudo faillog -m 3

The -l option sets the lock time.

faillog -m 3 -l 3600

To unlock an account

faillog -u login_name -r

Credits: http://blog.bodhizazen.com/linux/ubuntu-how-to-faillog/

Good luck and I hope you make the wise choice to stay with Ubuntu.