Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to configure the no. of times user will be prompted for password(authentication attempts) for login, before dropping the session. Does PAM support this case, if so can you help me out with the configuration required for this ?

share|improve this question
add comment

2 Answers

If you're trying to control how many times someone will be prompted, rather than how many times they can fail to authenticate, you might have trouble managing this through PAM. For example, ssh has its own config for this:

     NumberOfPasswordPrompts
         Specifies the number of password prompts before giving up.  The
         argument to this keyword must be an integer.  The default is 3.
share|improve this answer
    
Hi Joshua, Thanks for your reply. I'm using SSH service by xinetd, I read somewhere that whichever(among SSH & PAM) is lesser is taken into effect. Do you know how to configure this in PAM ? –  Sravani Oct 7 '13 at 15:31
    
I don't know how to configure this in PAM, and I also don't know if it's possible. In this case you're trying to define how many times an application will ask PAM, which is out of PAM's control. I feel like this is like trying to specify how many database queries an application will issue by setting a configuration parameter in the database; it's outside of the database's control. –  Joshua Miller Oct 7 '13 at 17:13
add comment

There is a login counter module for PAM called pam_tally which can be used maintain a count of attempted login attempts, and block further attempts if a certain number of login attempts fail.

Example:

On Debian you could add the following lines to /etc/pam.d/common-auth to give users three login attempts before the account is locked:

auth required pam_tally.so onerr=fail deny=3 no_magic_root

The no_magic_root prevents the root user from being locked out.

As peterph pointed out, the unlock_time option can be used to specify a number of seconds after which a locked-out account will automatically be unlocked. By setting this option to 1, i.e. locking the account for one second, the login attempt can be aborted after a specified number of tries, while still allowing the user to retry (almost) immediately.

Adding the following line to /etc/pam.d/common-account will reset the login count on a successful login:

account required pam_tally.so reset no_magic_root

On Fedora, both lines can be added to /etc/pam.d/system-auth.

Access to a locked-out user account can be restored with the accompanying pam_tally utility as follows:

$ pam_tally --user user --reset=0
share|improve this answer
    
Hi Thomas, Thanks for your prompt response. I do not want to lock the user, he should be able to try logging in again. I would like to control the no. of authentication attempts before dropping the session. –  Sravani Oct 7 '13 at 13:53
    
@Sravani that's exactly what pam_tally does. Just use unlock_time=1 - that will lock the account for one second. You may also try -1 (if I'm reading the code right, it should work). –  peterph Oct 7 '13 at 14:45
    
Thanks Thomas for your advice. This should work for me but I already have another requirement to lock the user upon a configurable no. of attempts, for that purpose I'm using hte pam_tally2 config. Will it work if I have 2 lines with different deny=<value> parameter. –  Sravani Oct 7 '13 at 15:46
    
@Sravani I'm assuming that will work as long as you use separate files to keep the login counts for each module invocation. pam_tally defaults to using /var/log/faillog, while pam_tally2 defaults to /var/log/tallylog. Both accept a file options which can be used to specify the tally file. –  Thomas Nyman Oct 7 '13 at 17:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.