Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-on state. And so your encrypted hard drive doesn’t increase your security at all since it’s currently unlocked.

This is how this blog article explains the problem and the setup on Debian.
A good solution may thus be to shutdown the device, when you have entered the wrong user-unlock password for e.g. 4 times.

However, I e.g. struggle to even find the common-auth or common-account in /etc/pam.d in my system there. (Fedora) Also, I guess, the article could be a little outdated or maybe not the best solution. And as I have not found this question being asked here already, I thought I'd better ask.

So in general: How do I configure an automatic shutdown after the x-th wrong entered password?

Note this is a security-requirement, so you should not e.g. not be able to cancel the shutdown. Also, it would be a little bad if you e.g. count for each user to 3, you should actually better have some global counter, so the attacker cannot switch to another user for trying their login first.

Cross-posted at AskFedora.

  • Side note, a wrong password should already be forcing a ≈1s delay. If someone can crack your password at 1 try per second then you need a better password. (Though this may still make sense as a defense-in-depth approach.) – derobert Apr 9 '19 at 16:23
  • From the blog script ...chmod 777 "${COUNTFILE}" .... This seems wrong and mildly insecure. – RubberStamp Apr 9 '19 at 17:27
  • @derobert It certainly makes sense, because I consider that users use a much longer (and harder to brute-force) password for luks than the simple login password. (And when you can shutdown, you force them to attack the long password.) – rugk Apr 10 '19 at 6:37
  • 1
    @rugk wiping the LUKS header may also make sense. Also, LUKS password had better be stronger, at least another 6+ random letters/numbers because it's an offline attack, so much faster guessing possible. At least with a budget. (of course, someone with a budget will have much better attacks on the booted laptop). – derobert Apr 10 '19 at 6:44

You could use pam_tally2 and pam_exec to achieve this result.

If you add the following at the beginning of /etc/pam.d/login, the system should shutdown on the 6th attempt after 5 failed logins.

auth [success=1 new_authtok_reqd=ok ignore=ignore default=bad] pam_tally2.so onerr=succeed deny=5 even_deny_root unlock_time=30
auth required pam_exec.so /usr/bin/poweroff
  • success=1 skips the next line preventing the shutdown of the system if pam_tally2 succeeds.
  • unlock_time=30 unlocks the account automatically after 30 seconds in order to prevent a permanent lockout of your root account.

Note: If you use a display manager (like GDM, LightDM, etc.) you probably need to add a similar rule to the respective PAM-configuration (possible without even_deny_root and unloock_time, if you don't allow graphical root login).


Besides the PAM option, there is also the possibility of using the logs.Now, I switched from Fedora to Slackware, so the exact files may be wrong, but if you put something like this:


if [ -f /tmp/erlogin ] ; then
    oldvalue=$(cat /tmp/erlogin)
    newvalue=$(grep 'invalid password' /var/log/secure|wc -l)
    if [ $((newvalue-oldvalue)) -gt 3 ] ; then
        shutdown -h now
grep 'invalid password' /var/log/secure|wc -l> /tmp/erlogin

And that every 10 minutes or so.

  • 1
    Nice idea and short script, however a) you are missing some clear instructions on how to setup. (but that is probably not that bad) b) of course, there is a interval until the script triggers, which allows more than three guesses if you are fast and c) the file /var/log/secure actually did not exist in my Fedora system here. – rugk Apr 17 '19 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.