I would like to configure the no. of times user will be prompted for password(authentication attempts) for login, before dropping the session. Does PAM support this case, if so can you help me out with the configuration required for this ?
There is a login counter module for PAM called
pam_tally which can be used maintain a count of attempted login attempts, and block further attempts if a certain number of login attempts fail.
On Debian you could add the following lines to
/etc/pam.d/common-auth to give users three login attempts before the account is locked:
auth required pam_tally.so onerr=fail deny=3 no_magic_root
no_magic_root prevents the root user from being locked out.
As peterph pointed out, the
unlock_time option can be used to specify a number of seconds after which a locked-out account will automatically be unlocked. By setting this option to
1, i.e. locking the account for one second, the login attempt can be aborted after a specified number of tries, while still allowing the user to retry (almost) immediately.
Adding the following line to
/etc/pam.d/common-account will reset the login count on a successful login:
account required pam_tally.so reset no_magic_root
On Fedora, both lines can be added to
Access to a locked-out
user account can be restored with the accompanying
pam_tally utility as follows:
$ pam_tally --user user --reset=0
If you're trying to control how many times someone will be prompted, rather than how many times they can fail to authenticate, you might have trouble managing this through PAM. For example, ssh has its own config for this:
NumberOfPasswordPrompts Specifies the number of password prompts before giving up. The argument to this keyword must be an integer. The default is 3.