Re: Authentication problems with pam_tally2 and Ansible

--===============9098090072191623201==
Content-Type: multipart/alternative; boundary=94eb2c0331580a97760542949f8a

--94eb2c0331580a97760542949f8a
Content-Type: text/plain; charset=UTF-8

The explanation seems to be that pam_tally2 records a failed login when
login command is started, even before a password is entered. Normally, the
failed logins counter is reset when the user enters the correct password.

For login this works correctly when the following line is added in pam
config (common-auth):

auth  required  pam_tally2.so  file=/var/log/tallylog deny=5 even_deny_root
unlock_time=1200 serialize

However, when using sudo, the counter only gets reset when the following
line is added to pam configuration (common-account):

account        required        pam_tally2.so

Why is the behaviour different for login and sudo?
Is this a bug?

I think this is a bit confusing and it might be good to explain it in more
detail on the man page (and the examples section).

marko

--94eb2c0331580a97760542949f8a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_extra">The =
explanation seems to be that pam_tally2 records a failed login when login c=
ommand is started, even before a password is entered. Normally, the failed =
logins counter is reset when the user enters the correct password.<br></div=
><div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra">For login =
this works correctly when the following line is added in pam config (common=
-auth):</div><div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra=
">auth =C2=A0required =C2=A0pam_tally2.so =C2=A0file=3D/var/log/tallylog de=
ny=3D5 even_deny_root unlock_time=3D1200 serialize</div><div class=3D"gmail=
_extra"><br></div><div class=3D"gmail_extra">However, when using sudo, the =
counter only gets reset when the following line is added to pam configurati=
on (common-account):</div><div class=3D"gmail_extra"><br></div><div class=
=3D"gmail_extra">account =C2=A0 =C2=A0 =C2=A0 =C2=A0required =C2=A0 =C2=A0 =
=C2=A0 =C2=A0pam_tally2.so</div><div class=3D"gmail_extra"><br></div><div c=
lass=3D"gmail_extra">Why is the behaviour different for login and sudo?</di=
v><div class=3D"gmail_extra">Is this a bug?</div><div class=3D"gmail_extra"=
><br></div><div class=3D"gmail_extra">I think this is a bit confusing and i=
t might be good to explain it in more detail on the man page (and the examp=
les section).</div><div><br></div><div>marko</div></div></div>

--94eb2c0331580a97760542949f8a--


--===============9098090072191623201==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pam-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/pam-list
--===============9098090072191623201==--