Lab 33.1 - changes to /etc/pam.d/sshd don't work on Ubuntu

ronniegane

I see this has been mentioned before but I just want to let you know it's still a problem.

On Ubuntu 18.04, if you add the lines to /etc/pam.d/sshd to try and lock out users after 3 failed login attempts:

auth required pam_tally2.so deny=3 onerr=fail
account required pam_tally2.so

It has no effect, users can still try to log in as many times as they want. pam_tally2 doesn't seem to record anything.

➜  ~ ssh rocky@localhost 
rocky@localhost's password: 
Permission denied, please try again.
rocky@localhost's password: 
Permission denied, please try again.
rocky@localhost's password: 
rocky@localhost: Permission denied (publickey,password).
➜  ~ sudo pam_tally2 -u rocky
Login           Failures Latest failure     From
rocky               0    
➜  ~ ssh rocky@localhost
rocky@localhost's password: 
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-52-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage
....

I gather from this AskUbuntu thread maybe it's something quirky about Ubuntu? I'm not sure how to make it work though.

luisviveropena

Hi @ronniegane ,

I'll do a test case on Ubuntu 18.10 and I'll let you know of my findings as soon as I can.

Regards,
Luis.

luisviveropena

Hi @ronniegane ,

I was able to reproduce the issue on Ubuntu 18.10. I'm working on this and I'll provide you an update as soon as I have a fix.

Regards,
Luis.

luisviveropena

Hi @ronniegane ,

I was able to get it working. Please follow these steps:

1.- Edit file /etc/pam.d/common-auth , and put the lines at the beginning of the file:

auth required pam_tally2.so file=/var/log/tallylog onerr=fail deny=3
account required pam_tally2.so

Note: remove these lines from any other file under /etc/pam.d/* .

2.- Try an ssh connection and fail once. Then, before trying again, check as root if pam_tally2 is getting the failure. You should see the following:

root@ubuntu-18:~# pam_tally2 -u luis
Login           Failures Latest failure     From
luis                1    07/04/19 22:39:04  127.0.0.1

Note: change with your own user.

3.- Fail for second time in the ssh connection and see in another window if it's getting to pam_tally2.

root@ubuntu-18:~# pam_tally2 -u luis
Login           Failures Latest failure     From
luis                2    07/04/19 22:40:47  127.0.0.1

4.- Fail for third time and check the count again:

root@ubuntu-18:~# pam_tally2 -u luis
Login           Failures Latest failure     From
luis                3    07/04/19 22:41:47  127.0.0.1

5.- Now try entering the right password. You should not be able to connect.

luis@ubuntu-18:~$ ssh -l luis localhost
luis@localhost's password:  
Permission denied, please try again.
luis@localhost's password:

So, in short terms, it's working. It should give an error like "the account is locked" anyway, but I'm not getting it.

Regards,
Luis.

lee42x

Here are a couple things to try:
1/ The auth line must be before "common-auth" in the /etc/pam/sshd file, I insert it as the first line in the file.
2/ A bad password of does not count, type anything in as a password. With one bad password entered the command "pam_tally2 -u student" should have an error recorded.
3/ pam_tally2 no longer gives any type of failure other than permission denied.
4/ The account line to reset the pam_tally2 counter is no longer necessary. A successful login will reset the counter.

I have used this in Ubuntu 16.04 ->19.10

Regards Lee

lee42x

Sorry for the duplication of information, I didn't refresh the screen before replying.

One key element is that the pam_tally2 auth line comes before pam_unix.so as pam_unix.so can exit the authentication test sequence before pam_tally2 is called. Pam_tally 2 can go in either sshd or common-auth. If it is in common-auth then it may impact more than just ssh logins. Putting the pam_tally2 test in the pam/sshd file will affect only ssh connections.

Going for coffee now, Lee