Lab 33.1 - changes to /etc/pam.d/sshd don't work on Ubuntu

Hi @ronniegane ,

I'll do a test case on Ubuntu 18.10 and I'll let you know of my findings as soon as I can.

Regards,
Luis.

Hi @ronniegane ,

I was able to get it working. Please follow these steps:

1.- Edit file /etc/pam.d/common-auth , and put the lines at the beginning of the file:

auth required pam_tally2.so file=/var/log/tallylog onerr=fail deny=3
account required pam_tally2.so

Note: remove these lines from any other file under /etc/pam.d/* .

2.- Try an ssh connection and fail once. Then, before trying again, check as root if pam_tally2 is getting the failure. You should see the following:

root@ubuntu-18:~# pam_tally2 -u luis
Login           Failures Latest failure     From
luis                1    07/04/19 22:39:04  127.0.0.1

Note: change with your own user.

3.- Fail for second time in the ssh connection and see in another window if it's getting to pam_tally2.

root@ubuntu-18:~# pam_tally2 -u luis
Login           Failures Latest failure     From
luis                2    07/04/19 22:40:47  127.0.0.1

4.- Fail for third time and check the count again:

root@ubuntu-18:~# pam_tally2 -u luis
Login           Failures Latest failure     From
luis                3    07/04/19 22:41:47  127.0.0.1

5.- Now try entering the right password. You should not be able to connect.

luis@ubuntu-18:~$ ssh -l luis localhost
luis@localhost's password:  
Permission denied, please try again.
luis@localhost's password:

So, in short terms, it's working. It should give an error like "the account is locked" anyway, but I'm not getting it.

Regards,
Luis.

Sorry for the duplication of information, I didn't refresh the screen before replying.

One key element is that the pam_tally2 auth line comes before pam_unix.so as pam_unix.so can exit the authentication test sequence before pam_tally2 is called. Pam_tally 2 can go in either sshd or common-auth. If it is in common-auth then it may impact more than just ssh logins. Putting the pam_tally2 test in the pam/sshd file will affect only ssh connections.

Going for coffee now, Lee