Re: PAM faillock and sssd

Hi Tomas,

Thanks for your response.

On Jun 06, 2013, at 09:28 AM, Tomas Mraz <[email protected]> wrote:

This is not correct, the third pam_faillock line would never be called
as the second line will always fail. So you can remove it.
 
I see what you're saying, is this because [default=die] causes all return codes to act as though an error happened?  But why does the pam_faillock man page say to place the lines in this way?  Even more important why can I login successfully with that configuration?  Shouldn't I fail to login all the time?

I was under the impression that one of the lines has a success type function and the other one has a failure type function.

And just add
account required pam_faillock.so
line to the beginning of account section. Otherwise the fail count will
never be reset on successful authentication.
 
I have removed the 3rd line, and I have placed the account line at the beginning of the account section.  For some reason now, faillock does not increment new failures for my users.  Any ideas?
Bryan

_______________________________________________
Pam-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/pam-list