Welcome to the Linux Foundation Forum!

Lab 33.1 - changes to /etc/pam.d/sshd don't work on Ubuntu

I see this has been mentioned before but I just want to let you know it's still a problem.

On Ubuntu 18.04, if you add the lines to /etc/pam.d/sshd to try and lock out users after 3 failed login attempts:

auth required pam_tally2.so deny=3 onerr=fail
account required pam_tally2.so

It has no effect, users can still try to log in as many times as they want. pam_tally2 doesn't seem to record anything.

➜  ~ ssh rocky@localhost 
rocky@localhost's password: 
Permission denied, please try again.
rocky@localhost's password: 
Permission denied, please try again.
rocky@localhost's password: 
rocky@localhost: Permission denied (publickey,password).
➜  ~ sudo pam_tally2 -u rocky
Login           Failures Latest failure     From
rocky               0    
➜  ~ ssh rocky@localhost
rocky@localhost's password: 
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-52-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage
....

I gather from this AskUbuntu thread maybe it's something quirky about Ubuntu? I'm not sure how to make it work though.

Comments

  • luisviveropena
    luisviveropena Posts: 1,207

    Hi @ronniegane ,

    I'll do a test case on Ubuntu 18.10 and I'll let you know of my findings as soon as I can.

    Regards,
    Luis.

  • luisviveropena
    luisviveropena Posts: 1,207

    Hi @ronniegane ,

    I was able to reproduce the issue on Ubuntu 18.10. I'm working on this and I'll provide you an update as soon as I have a fix.

    Regards,
    Luis.

  • luisviveropena
    luisviveropena Posts: 1,207

    Hi @ronniegane ,

    I was able to get it working. Please follow these steps:

    1.- Edit file /etc/pam.d/common-auth , and put the lines at the beginning of the file:

    auth required pam_tally2.so file=/var/log/tallylog onerr=fail deny=3
    account required pam_tally2.so

    Note: remove these lines from any other file under /etc/pam.d/* .

    2.- Try an ssh connection and fail once. Then, before trying again, check as root if pam_tally2 is getting the failure. You should see the following:

    root@ubuntu-18:~# pam_tally2 -u luis
    Login           Failures Latest failure     From
    luis                1    07/04/19 22:39:04  127.0.0.1

    Note: change with your own user.

    3.- Fail for second time in the ssh connection and see in another window if it's getting to pam_tally2.

    root@ubuntu-18:~# pam_tally2 -u luis
    Login           Failures Latest failure     From
    luis                2    07/04/19 22:40:47  127.0.0.1

    4.- Fail for third time and check the count again:

    root@ubuntu-18:~# pam_tally2 -u luis
    Login           Failures Latest failure     From
    luis                3    07/04/19 22:41:47  127.0.0.1

    5.- Now try entering the right password. You should not be able to connect.

    luis@ubuntu-18:~$ ssh -l luis localhost
    luis@localhost's password:  
    Permission denied, please try again.
    luis@localhost's password:

    So, in short terms, it's working. It should give an error like "the account is locked" anyway, but I'm not getting it.

    Regards,
    Luis.

  • lee42x
    lee42x Posts: 380

    Here are a couple things to try:
    1/ The auth line must be before "common-auth" in the /etc/pam/sshd file, I insert it as the first line in the file.
    2/ A bad password of does not count, type anything in as a password. With one bad password entered the command "pam_tally2 -u student" should have an error recorded.
    3/ pam_tally2 no longer gives any type of failure other than permission denied.
    4/ The account line to reset the pam_tally2 counter is no longer necessary. A successful login will reset the counter.

    I have used this in Ubuntu 16.04 ->19.10

    Regards Lee

  • lee42x
    lee42x Posts: 380

    Sorry for the duplication of information, I didn't refresh the screen before replying.

    One key element is that the pam_tally2 auth line comes before pam_unix.so as pam_unix.so can exit the authentication test sequence before pam_tally2 is called. Pam_tally 2 can go in either sshd or common-auth. If it is in common-auth then it may impact more than just ssh logins. Putting the pam_tally2 test in the pam/sshd file will affect only ssh connections.

    Going for coffee now, Lee

Categories

Upcoming Training