Re: Authentication problems with pam_tally2 and Ansible

--===============5948005067016973118==
Content-Type: multipart/alternative; boundary=94eb2c0647fcd155b205429b2bd0

--94eb2c0647fcd155b205429b2bd0
Content-Type: text/plain; charset=UTF-8

Have you considered the problem of getting locked out of your computers
because some bozo on the Internet is trying a brute force attack?  I get
something like 20,000 failed logins for root every day.  You might as well
just turn off root login at the ssh config.

I use Fail2ban (there are others) to bloc the source IP of the attacker.  I
only block it for 15 minutes or so, but it's enough to slow down the
attacker and blunt the attack.  Block the badguy, not yourself or your
users. :-)

Good Luck!

-Dylan

On Dec 1, 2016 12:36 AM, "Marko Asplund" <[email protected]> wrote:

> The explanation seems to be that pam_tally2 records a failed login when
> login command is started, even before a password is entered. Normally, the
> failed logins counter is reset when the user enters the correct password.
>
> For login this works correctly when the following line is added in pam
> config (common-auth):
>
> auth  required  pam_tally2.so  file=/var/log/tallylog deny=5
> even_deny_root unlock_time=1200 serialize
>
> However, when using sudo, the counter only gets reset when the following
> line is added to pam configuration (common-account):
>
> account        required        pam_tally2.so
>
> Why is the behaviour different for login and sudo?
> Is this a bug?
>
> I think this is a bit confusing and it might be good to explain it in more
> detail on the man page (and the examples section).
>
> marko
>
> _______________________________________________
> Pam-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/pam-list
>

--94eb2c0647fcd155b205429b2bd0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><p dir=3D"ltr">Have you considered the problem of getting =
locked out of your computers because some bozo on the Internet is trying a =
brute force attack?=C2=A0 I get something like 20,000 failed logins for roo=
t every day.=C2=A0 You might as well just turn off root login at the ssh co=
nfig.</p><p>I use Fail2ban (there are others) to bloc the source IP of the =
attacker.=C2=A0 I only block it for 15 minutes or so, but it&#39;s enough t=
o slow down the attacker and blunt the attack.=C2=A0 Block the badguy, not =
yourself or your users. :-)</p><p>Good Luck!</p><p>-Dylan</p>
<div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Dec 1, 2016 12=
:36 AM, &quot;Marko Asplund&quot; &lt;<a href=3D"mailto:marko.asplund@gmail=
.com" target=3D"_blank">[email protected]</a>&gt; wrote:<br type=3D"a=
ttribution"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo=
rder-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div class=3D"g=
mail_extra"><div class=3D"gmail_extra">The explanation seems to be that pam=
_tally2 records a failed login when login command is started, even before a=
 password is entered. Normally, the failed logins counter is reset when the=
 user enters the correct password.<br></div><div class=3D"gmail_extra"><br>=
</div><div class=3D"gmail_extra">For login this works correctly when the fo=
llowing line is added in pam config (common-auth):</div><div class=3D"gmail=
_extra"><br></div><div class=3D"gmail_extra">auth =C2=A0required =C2=A0pam_=
tally2.so =C2=A0file=3D/var/log/tallylog deny=3D5 even_deny_root unlock_tim=
e=3D1200 serialize</div><div class=3D"gmail_extra"><br></div><div class=3D"=
gmail_extra">However, when using sudo, the counter only gets reset when the=
 following line is added to pam configuration (common-account):</div><div c=
lass=3D"gmail_extra"><br></div><div class=3D"gmail_extra">account =C2=A0 =
=C2=A0 =C2=A0 =C2=A0required =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_tally2.so</div>=
<div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra">Why is the =
behaviour different for login and sudo?</div><div class=3D"gmail_extra">Is =
this a bug?</div><div class=3D"gmail_extra"><br></div><div class=3D"gmail_e=
xtra">I think this is a bit confusing and it might be good to explain it in=
 more detail on the man page (and the examples section).</div><div><br></di=
v><div>marko</div></div></div>
<br>______________________________<wbr>_________________<br>
Pam-list mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
m</a><br>
<a href=3D"https://www.redhat.com/mailman/listinfo/pam-list" rel=3D"norefer=
rer" target=3D"_blank">https://www.redhat.com/mailman<wbr>/listinfo/pam-lis=
t</a><br></blockquote></div></div>
</div>

--94eb2c0647fcd155b205429b2bd0--


--===============5948005067016973118==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pam-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/pam-list
--===============5948005067016973118==--