Authentication problems with pam_tally2 and Ansible

--===============6502370086333372868==
Content-Type: multipart/alternative; boundary=001a11493bce36b27a0542318ca8

--001a11493bce36b27a0542318ca8
Content-Type: text/plain; charset=UTF-8

Hi,

I'm having some issues using the pam_tally2 module with Ansible and I'd
like to make sure my PAM configuration is correct.
I've configured pam_tally2 by adding the following line in
/etc/pam.d/common-auth:

auth  required  pam_tally2.so file=/var/log/tallylog  deny=5
 even_deny_root  unlock_time=1200

Is this line correct and in the right place? Is there some other
configuration I should add?

This seems to be working ok with interactive sessions, but I'm experiencing
strange authentication problems with Ansible. I've an Ansible playbook that
basically runs the chage command for a bunch of users in a loop with sudo.
Some of the commands get correctly executed but playbook execution gets
aborted due to "Incorrect sudo password". Also, pam_tally2 reports multiple
login failures for the user running the script. Since some of the chage
commands succeed the sudo password must have been correctly typed.

Can this be caused by a flawed pam_tally2 configuration?
This is on Ubuntu 16.04.

marko

--001a11493bce36b27a0542318ca8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi,</div><div><br></div><div>I&#39;m having some issu=
es using the pam_tally2 module with Ansible and I&#39;d like to make sure m=
y PAM configuration is correct.</div><div>I&#39;ve configured pam_tally2 by=
 adding the following line in /etc/pam.d/common-auth:<br></div><div><br></d=
iv><div>auth =C2=A0required =C2=A0pam_tally2.so file=3D/var/log/tallylog =
=C2=A0deny=3D5 =C2=A0even_deny_root =C2=A0unlock_time=3D1200</div><div><br>=
</div><div>Is this line correct and in the right place? Is there some other=
 configuration I should add?</div><div><br></div><div>This seems to be work=
ing ok with interactive sessions, but I&#39;m experiencing strange authenti=
cation problems with Ansible. I&#39;ve an Ansible playbook that basically r=
uns the chage command for a bunch of users in a loop with sudo. Some of the=
 commands get correctly executed but playbook execution gets aborted due to=
 &quot;Incorrect sudo password&quot;. Also, pam_tally2 reports multiple log=
in failures for the user running the script. Since some of the chage comman=
ds succeed the sudo password must have been correctly typed.</div><div><br>=
</div><div>Can this be caused by a flawed pam_tally2 configuration?<br></di=
v><div>This is on Ubuntu 16.04.<br></div><div><br></div><div>marko</div></d=
iv>

--001a11493bce36b27a0542318ca8--


--===============6502370086333372868==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pam-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/pam-list
--===============6502370086333372868==--