Limit User Login Attempts (Ubuntu 12.10, pam_tally.so, pam_tally2.so)

First, I am a relative Linux newbie, so bear with me.

Much of the advice I have found on the web for limiting login attempts does not pertain to Quantal. All of it does specify using pam_tally.so or pam_tally2.so, which seem to be the fundamental Linux mechanisms for user authentication. Unfortunately, it also appears that various distros (RHEL, Ubuntu, Cent, etc.) have slight variations for configuration requirements.

In 12.10, after enabling pam_tally.so, the main problems I have encountered are related to incorrect tally incrementing:

• increments 2 times for every login failure
• increments all other users when a user fails
• increments all other when a user switches accounts

And other variations of this behavior. However, it does lock accounts that exceed the limit, as required, and resets the counter to 0 after a successful login.

pam_tally2.so eliminates some of the errors, such as incrementing all other users when a different user fails, but still increments the user 2 times for every failure.

Here is what my /etc/pam.d/common-auth looks like:

auth required pam_tally2.so file=/var/log/tallylog deny=3 auth [success=1 default=ignore] pam_unix.so account required pam_tally2.so auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so 

If I duplicate the instructions on manpages for pam_tally2.so, I am locked out of the machine and have to undo the changes via root from a LiveCD boot.

My questions are:

1. Is pam_tally.so now fully deprecated in favor of pam_tally2.so?
2. Does anyone have a working common-auth file they can post, which works exactly as advertised, for 12.10? Any other suggestions are welcome as well.
3. Does 13.04 use a different mechanism than pam_tally to manage login counts & lockouts?

If 13.04 does limit logins correctly, with less hassle than 12.10, I would probably migrate to it since limiting login attempts is a necessary feature for this machine. If login attempts cannot be limited in some version of Ubuntu, I will likely have to use another distro, like CentOS.

1 Answer

This is from the pam_tally "man" page.

pam_tally has several limitations, which are solved with pam_tally2. For this reason pam_tally is deprecated and will be removed in a future release.

You can view it (and any other command in this format) by entering the following into Terminal:

man pam_tally 

Do you intend to implement lockouts at the keyboard and/or over the network (ssh)? I don't have an example for you but below you may 'find the answers you seek.' First you'll need to edit that file you mentioned by entering this from Terminal:

sudo gedit /etc/pam.d/common-auth 

Add this at the top of the file (order of rules matters):

auth required pam_tally.so per_user magic_root onerr=fail 

This sets the number of allowed attempts

sudo faillog -m 3 

The -l option sets the lock time.

faillog -m 3 -l 3600 

To unlock an account

faillog -u login_name -r 

Credits:

Good luck and I hope you make the wise choice to stay with Ubuntu.