I am currently running Ubuntu GNOME 15.10 with GNOME 3.18, though I used to (a long while back) run Windows 7, and though Ubuntu is better in most ways, there is still a feature lacking or at least a feature which I haven't found yet...

Is there any way of making it so that on the locked/login screen after a certain number (defined by me) of incorrect password attempts it doesn't allow the user to enter their password for a certain amount of time (defined by me) and also logs this to a log?

So for instance if a user enters an incorrect password 3 times they are not allowed to try again for another 5 minutes and this is also logged to a log defined by me.

It would also be useful if I could also optionally make it so that say the user tries to enter their password and gets it wrong 2 times, if they within the next 5 minutes try again it locks them out for 5 minutes, however if they try again after 5 minutes have gone the counter of incorrect password attempts is reset back to 0.

Is there already such a feature? Or perhaps a way of manually implementing it with a script or something?

  • Have you looked at PAM (programable authentication modules)? That allows all sorts of limitations to be placed upon login. – ubfan1 Jan 17 '16 at 16:32
  • @ubfan1: No, how would I configure that? – user364819 Jan 17 '16 at 18:43
  • apt-cache search PAM shows about 300 packages that mention PAM. Most of these packages do not apply, but some do. Investigate these packages, consider installing some of them, read the documentation, THEN configure. Keep a shell session powerful enough to undo all the changes open. Educate self first. – waltinator Jan 17 '16 at 19:06
  • man pam_tally2 should be pretty close to what you need. – ubfan1 Jan 17 '16 at 19:33

Some background info:

User log-ins are handled by the PAM system (Pluggable Authentication Module) and in this particular case by the pam_tally subsystem (to tally the user accounts).

As pam_tally itself will be deprecated, you should use pam_tally2, which comes in two parts:

  1. pam_tally2.so being the module that does the authentication itself and which you need to add to the PAM system
  2. pam_tally2 being a stand-alone program that you'll need to display, change and clear individual counts

The parameters of pam_tally2 you're interested in are:

    Deny access if tally for this user exceeds n.
    Always deny for n seconds after failed attempt.
    Allow access after n seconds after failed attempt. If this
    option is used the user will be locked out for the specified
    amount of time after he exceeded his maximum allowed attempts.
    Otherwise the account is locked until the lock is removed by a
    manual intervention of the system administrator.
    If the module is invoked by a user with uid=0 the counter is
    not incremented. 
    Root account can become unavailable.

The configuration:

Add the following lines to /etc/pam.d/login to lock the account after 3 failed logins (also for the root account) and have it unlocked automatically after 50 minutes.

auth     required       pam_securetty.so
auth     required       pam_tally2.so deny=3 even_deny_root lock_time=60 unlock_time=3000
auth     required       pam_env.so
auth     required       pam_unix.so
auth     required       pam_nologin.so
account  required       pam_unix.so
password required       pam_unix.so
session  required       pam_limits.so
session  required       pam_unix.so
session  required       pam_lastlog.so nowtmp
session  optional       pam_mail.so standard

After adding the above congiguration, test it and log out and do try to log in 3 times with a bogus password: 60 seconds to wait after first and second attempt and 50 minutes after the third try.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy