I am trying to implement account lockout in ubuntu using pam_tally. I have tried adding the follwing lines in /etc/pam.d/common-auth
auth required pam_tally.so deny=3
account required pam_tally.so
The failures are getting logged but account is not getting locked even on reaching max failures. I am trying this by directly loggging in (GNOME login screen).
Any advices? Do I need to add in pam.d/gdm or login file also?
If you're just looking for a quick fix, go below to How to Configure common-auth to Lock Out.
Hopefully this will help bring some sense into how /etc/pam.d/common-auth configures lockout.
If you take out all the comments in /etc/pam.d/common-auth, you are left with the following:
auth [success=1 default=ignore] pam_unix.so nullok_secure
auth requisite pam_deny.so
auth required pam_permit.so
Let's take a look at each line of this file and how it's used.
auth [success=1 default=ignore] pam_unix.so nullok_secure
Reads password input. If the password is correct, the next line of the file is skipped (the one with pam_deny.so). You can change how many lines are skipped by setting the value in success=1.
auth requisite pam_deny.so
Immediately fail the login attempt. The word requisite here tells the authentication to quit immediately upon failure. The other lines use required instead, which waits until the end of the module to signal a failure.
auth required pam_permit.so
Permits login attempt. This is done using pam_permit.so.
Once that is established, configuring the module to lock out the user can be better understood.
For Ubuntu:
Add the following line after pam_deny.so and before pam_permit.so:
auth required pam_tally2.so onerr=fail deny=3 unlock_time=1800
Change the pam_deny.so line to the following:
auth required pam_deny.so
The entire file would look like this:
auth [success=1 default=ignore] pam_unix.so nullok_secure
auth required pam_deny.so
auth required pam_tally2.so onerr=fail deny=3 unlock_time=1800
auth required pam_permit.so
You can configure the following options to suit your needs:
deny=3 - The number of attempts allowed before you are locked out.unlock_time=1800 - The number of seconds before you are allowed to attempt to log in again. (Additional note: if the system unlocks after a series of failures, and you fail to authenticate again, you do not have 2 more tries to authenticate. The system makes you wait out the unlock-time again.)Most resources recommend that this line be added at the top of the file, emphasizing the importance of order; however, on Ubuntu desktop systems, this configuration can lock you out of the GUI login screen.
Why does this happen? It seems that when you select a user on Ubuntu's login screen, the PAM module immediately begins, and it waits at the pam_unix.so line (the password input line) before proceeding. If you place the pam_tally2.so line before this "stopping point", lockout immediately becomes active, and if you navigate away from the user by pressing the arrow keys, the module signals a failure to log in and pam_tally2 increments. Without even typing a password, you soon become stuck in a situation similar to the one below:
A typical Ubuntu login screen with an incorrectly configured common-auth file.
Placing the pam_tally2.so line at the bottom of the file fixes this problem. Proper order is maintained in this configuration; the first line jumps to pam_deny.so or pam_permit.so based on password validity, and by the time pam_tally2.so is reached, any incorrect password entries have already been indicated.
Even though pam_permit.so is reached regardless of the password entered, the module will always fail if pam_deny.so has been reached as well. This is because the pam_deny.so line contains required; it will allow the rest of the lines to run, but the module itself will fail in the end.
For more information on how PAM works, you can google "How PAM works" or just go here: http://www.tuxradar.com/content/how-pam-works
That should do it!
It has been a while since I looked at this, but
I think you need to edit /etc/pam.d/common-auth
Add this at the top of the file (order of rules matters).
auth required pam_tally.so per_user magic_root onerr=fail
You then set the number of allowed attempts
sudo faillog -m 3
To unlock an account
faillog -u login_name -r
for additional details see
My blog http://blog.bodhizazen.com/linux/ubuntu-how-to-faillog/
You could also try faillock to lock the user accounts after n failed login attempts.
I was able to get it working by following the instructinos in the link below which uses pam_faillock.so which I guess works both on Ubuntu and CentOS.
On CentOS and Similar Derivatives:
/etc/pam.d/system-auth
/etc/pam.d/password-auth
On Ubuntu/Debian and Similar Derivatives:
/etc/pam.d/common-auth
/etc/pam.d/common-account
Lock Linux User Account after Multiple Failed Login Attempts
hope this helps someone else too.
