0

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file :

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        required      pam_faillock.so preauth silent audit deny=5 even_deny_root unlock_time=9999999
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        [default=die] pam_faillock.so authfail audit deny=5 even_deny_root unlock_time=99999999
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so
auth        required      pam_tally.so onerr=succeed deny=5 even_deny_root_account

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
account     required      pam_faillock.so
password    requisite     pam_cracklib.so try_first_pass retry=5 minlen=8 minclass=3 max_repeat=1 difok=5 dcredit=1 ucredit=1 lcredit=1 ocredit=1 maxrepeat=1 gecoscheck enforce_for_root type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

This is the content of my /etc/pam.d/password-auth :

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        required      pam_faillock.so preauth silent audit deny=5 unlock_time=99999
auth        sufficient    pam_unix.so nullok try_first_pass
auth        [default=die] pam_faillock.so authfail audit deny=5 unlock_time=99999
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
account     required      pam_faillock.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

I use CentOS 6.5, pam says that there is 0 failures. EDIT : The account is locked after 5 try but if I restart the computer, the account is unlocked... Why ?

  • Which distro you using? What version? And pam_tally2 --user "youraccountname' gives what? – Babin Lonston Jan 9 at 10:33
  • PAM locks the account of a specific amount of time or until you restart the server as PAM is designed to lock the account temporaly, not permanently. – Dasel Jan 9 at 13:39
0

Your config looks correct as far as I can tell.

But if your using ssh to login, make sure UsePAM is set to yes in your sshd_config file. Otherwise all things PAM are ignored for ssh logins! And it defaults to no.

  • No, I don't use ssh, I just want to block on CentOS login screen. – Anonyme Jan 9 at 10:37
0

I suppose that you have restarted the system in order to apply all the changes, otherwise the login application could not be recognising the changes.

You have to also apply the restrictions in the /etc/pam.d/login file to be sure that PAM will block the access after unsuccessful logins in every cases as each PAM module has different purpouses.

login: Rules for local login.

system-auth: Common rules for many services.

password-auth: Common rules for many remote services.

sshd: Rules for SSHD daemon only.

0

I finded the good order and good syntax. I make severals tests and finnaly it works. Maybe the problem was a typing error. So this is the PAM's parameters to block a user after 5 try on lock screen. The parameters contains also some rules to prevent too simple password changing.

Note : The counter is reset when computer restarts.

/etc/pam.d/system-auth :

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        required      pam_faillock.so preauth silent audit deny=5 even_deny_root unlock_time=99999
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        [default=die] pam_faillock.so authfail audit deny=5 unlock_time=99999
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
account     required      pam_faillock.so

password    requisite     pam_cracklib.so try_first_pass retry=5 minlen=8 minclass=3 max_repeat=1 difok=5 dcredit=1 ucredit=1 lcredit=1 ocredit=1 maxrepeat=1 gecoscheck enforce_for_root type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

Content of /etc/pam.d/password-auth :

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        required      pam_faillock.so preauth silent audit deny=5 unlock_time=99999
auth        sufficient    pam_unix.so nullok try_first_pass
auth        [default=die] pam_faillock.so authfail audit deny=5 unlock_time=99999
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so
account     required      pam_faillock.so

password    requisite     pam_cracklib.so try_first_pass retry=5 minlen=8 minclass=3 max_repeat=1 difok=5 dcredit=1 ucredit=1 lcredit=1 ocredit=1 maxrepeat=1 gecoscheck enforce_for_root type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.