4

SERVER:/etc/pam.d # head -1 /etc/issue

SUSE LINUX Enterprise Server 9.4

SERVER:/etc/pam.d # cat login

#%PAM-1.0
auth requisite  pam_unix2.so    nullok     #set_secrpc
auth required   pam_securetty.so
auth required   pam_nologin.so
#auth    required   pam_homecheck.so
auth required   pam_env.so
auth required   pam_mail.so
#account required pam_tally.so deny=5 reset no_magic_root
account required    pam_unix2.so
password required   pam_pwcheck.so  nullok md5
password required   pam_unix2.so    nullok use_first_pass use_authtok md5
session required    pam_unix2.so    none     # debug or trace
session required    pam_limits.so

SERVER:/etc/pam.d # cat sshd

#%PAM-1.0
auth     required   pam_tally.so no_magic_root
auth     required       /lib/security/pam_unix.so   # set_secrpc
auth     required       /lib/security/pam_nologin.so
auth     required       /lib/security/pam_env.so
#account required pam_tally.so deny=5 reset no_magic_root
account  required       /lib/security/pam_unix.so
password required       /lib/security/pam_pwcheck.so
password required       /lib/security/pam_unix.so       use_first_pass use_authtok md5
session  required       /lib/security/pam_unix.so   none # trace or debug
session  required       /lib/security/pam_limits.so
SERVER:/etc/pam.d # 
SERVER:/etc/pam.d # 

SERVER:/etc/pam.d # faillog -u pamtest

Username   Failures  Maximum  Latest
pamtest           0        5  Thu Aug 29 13:35:15 +0200 2013 on localhost

SERVER:/etc/pam.d # ssh pamtest@localhost

pamtest@localhost's password: 
Last login: Thu Aug 29 13:35:15 2013 from localhost
pamtest@SERVER:~> exit
logout
Connection to localhost closed.
SERVER:/etc/pam.d # faillog -u pamtest
Username   Failures  Maximum  Latest
pamtest           1        5  Thu Aug 29 13:39:40 +0200 2013 on localhost
SERVER:/etc/pam.d # 

Q: Why does the system logs the successful login as failed login? "UsePAM yes" is in the sshd_config. (Does the order of the lines in the ex.: sshd file counts?)

3

'pam_tally.so' should be included in 'account' section as well as in 'auth' section. This will clear the failed attempts count after successful login. Add the following line to /etc/pam.d/sshd:

account required pam_tally.so
  • 1
    Close, but for me, it had to be account required pam_tally2.so – SEoF Feb 20 '18 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.