12

I am having trouble with a configuration line in common-account-pc and common-auth-pc that denies also root access:

account  required  pam_tally2.so  deny=10 onerr=fail unlock_time=600 even_deny_root root_unlock_time=5 file=/home/log/faillog

It seems that this line causes some problem when trying to access multiple times the SUT and i assume that it things that it is an attack via ssh. But it is actually a test tool that tries to send several times commands via ssh root@ to the SUT (100.100.100.100) from server (10.10.10.13).

Apr 25 05:51:56 SUT sshd[31570]: pam_tally2(sshd:auth): user root (0) tally 83, deny 10
Apr 25 05:52:16 SUT sshd[31598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.10.10.13  user=root
Apr 25 05:52:21 SUT sshd[31568]: error: PAM: Authentication failure for root from 10.10.10.13
Apr 25 05:52:21 SUT sshd[31568]: Connection closed by 10.10.10.13 [preauth]

Since the password is always correct, but still after some time it starts to through exception (pexpect) Account locked.

version: 2.3 ($Revision: 399 $)
command: /usr/bin/ssh
args: ['/usr/bin/ssh', '[email protected]']
searcher: searcher_re:
    0: re.compile(".*:~ #")
buffer (last 100 chars): :
Account locked due to 757 failed logins

Password:
before (last 100 chars): :
Account locked due to 757 failed logins

Password:
after: <class 'pexpect.TIMEOUT'>
...

But according to passwd root is not LK labeled:

SUT:~ # passwd -S root
root P 04/24/2017 -1 -1 -1 -1

Manually it is always possible to access the SUT via ssh root@!!!

So, for the moment the only that can cause this is the pam configuration. But how do i restart or activate the changes?

Does someone else have any other idea?

Thanks in adv.

3 Answers 3

15

There is no PAM daemon. You do not need to reload anything for the changes to take effect.

3
  • 6
    I dont think this is correct. Some changes in /etc/pam.d/sshd do not get reflected when restarting sshd service and only take effect after rebooting the machine.
    – Basil A
    Apr 26, 2020 at 13:48
  • 1
    Hi Basil, whic ones specifically? Jul 17, 2022 at 18:35
  • I too would like to know which changes in /etc/pam.d/sshd_config do not get reflected when restarting the sshd service. Per redhat.com/sysadmin/pluggable-authentication-modules-pam suggest otherwise... PAM = "pluggable"
    – ron
    Nov 17, 2022 at 14:40
2

For folks like me still finding this question:

sudo pam-auth-update --force --package

According to the man page, --package is to tell pam-auth-update that you are a maintainer script and should not be prompted interactively.

I needed to use this command to make SSH login work after editing settings in /etc/pam.d/common-password.

0

Maybe there are better/shorter approaches but I did a reload of my PAM auth configuration changes by running:

sudo /usr/sbin/pam-auth-update

Do not change anything in the window which'll popup and just press "Ok".

1
  • 1
    Have you an automatic way for unattented purpose ? I don't understand your -1
    – Et7f3XIV
    Jul 4, 2022 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .