I'm not sure if this issue is with
pam_tally2 itself or with Ubuntu which is what I'm trying to find out.
pam_tally2 for some reason is having issues on 14 and 16. My
/etc/pam.d/common-auth file looks as follows:
auth required pam_env.so auth required pam_tally2.so deny=5 unlock_time=900 onerr=fail auth [success=1 default=ignore] pam_unix.so nullok_secure auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so
The first two lines I inserted manually based on previous forums and the man page. (For testing purposes I changed
=20 so as not to take so long testing).
- After doing so, nothing seems to take effect until I reboot the machine which is unlike pam where usually changes to pam take effect immediately.
- After rebooting and intentionally failing password input 3 times I am successfully locked out for 20 seconds however I notice the counter says I failed 4 times even though it's only 3. Also taking note, when inputting the wrong password, the usual message displayed is
Invalid password, please try again, in red text and once the system is locked out, the message
Account locked due to 4 failed logins, appears in white text.
- After waiting 20 seconds and inputting the correct password, it still fails me one more time before changing the fail text to the original red text but then unlocking after I put the password in correctly yet again. Furthermore, the account lockout only seems to work on the first login after the system reboot. If I login correctly that once or intentionally fail logging in, afterwards, I will be able to login no matter how many times I fail.
Some forums and blogs say that you also need to put:
account required pam_tally2.so
common-account file also
Other forums say to put the the aforementioned line but with all the options that you put in the
common-auth file too. Neither of these approaches seem to make pam_tally2 work.
I've also tried experimentally to put
account required pam_env.so
common-account file as the first line. This doesn't seem to work or change anything either.
I've tried putting the
pam_env.so line above and below the
pam_tally2.so in both files in all possible combinations and this doesn't seem to correct the behavior.
If anyone knows why
pam_tally2.so isn't working or if it's a bug with Ubuntu please let me know. Thank you for your time.