I am trying to use
I change sshd to the following content
#%PAM-1.0 auth required pam_securetty.so auth required pam_tally2.so deny=3 unlock_time=600 auth required pam_env.so auth required pam_unix.so auth required pam_nologin.so account required pam_unix.so password required pam_unix.so session required pam_limits.so session required pam_unix.so session required pam_lastlog.so nowtmp session optional pam_mail.so standard
I created a test account; before login, I tested the failed login count:
pam_tally2 -u tst3402 (empty)
now I log in using the correct password (this is done by an
expect script, password is like
spawn ssh -l tst3402 18.104.22.168 Password: No mail. Last login: Tue Mar 20 14:25:17 2018 from 22.214.171.124 tst3402@hostname:~> status OK
- status OK is sent by
I recheck the failure count
pam_tally2 -u tst3402 Login Failures Latest failure From tst3402 1 03/20/18 14:25:17 126.96.36.199
This implies that after 3 sucessful logins, the account is locked.
why after a succesful login does
pam_tally2 see 1 failures ?
I know I can use ssh keys, but I am under ISAE3420's curse
using ssh -vvv -l ... I see two exchange .. I should see 2 failures ?
debug3: send packet: type 50 debug3: receive packet: type 51
there is no SELinux
I didn't find any pam_tally2 question in security.SE