1

I've been trying to add more security to passwords, etc. I did the following things (in Ubuntu 14.04.2 LTS)

in /etc/pam.d/common-auth, added (as first line)

auth required pam_tally.so onerr=fail deny=3 unlock_time=3600 magic_root

in /etc/pam.d/common-password:

password [success=1 default=ignore] pam_unix.so obscure sha512 minlen=14 remember=24 audit

in /etc/login.defs

PASS_MAX_DAYS 60 
PASS_MIN_DAYS 1 
PASS_WARN_AGE 14 
LOG_OK_LOGINS yes
SULOG_FILE /var/log/sulog 
SYSLOG_SU_ENAB yes 
SYSLOG_SG_ENAB yes

I cannot log in from either the GUI or the text console. I dropped into the root shell from recovery mode, did mount -rw -o / and tried both changing my password and creating a new user, no joy.

What did I screw up? Please and thank you.

  • Did you reboot after all this? – TheWanderer May 11 '15 at 21:52
  • I did. Multiple times. – betseyb May 12 '15 at 13:26
0

Through extensive trial and error, it appears that the culprit was

auth required pam_tally.so onerr=fail deny=3 unlock_time=3600 magic_root

Removing

deny=3 unlock_time=3600

and instead doing

sudo faillog -l 3600 -m 3

appears to have done the trick.

I would still like to understand why, if anyone can offer an explanation. I chose those options based on the pam_tally man page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.