Bdtyktl

I'm not sure if this issue is with pam_tally2 itself or with Ubuntu which is what I'm trying to find out. pam_tally2 for some reason is having issues on 14 and 16. My /etc/pam.d/common-auth file looks as follows:

auth      required      pam_env.so

auth      required      pam_tally2.so deny=5 unlock_time=900 onerr=fail

auth      [success=1 default=ignore]   pam_unix.so nullok_secure

auth      requisite     pam_deny.so

auth      required      pam_permit.so 

auth      optional      pam_cap.so

The first two lines I inserted manually based on previous forums and the man page. (For testing purposes I changed deny to =3 and unlock_time to =20 so as not to take so long testing).

1. After doing so, nothing seems to take effect until I reboot the machine which is unlike pam where usually changes to pam take effect immediately.


2. After rebooting and intentionally failing password input 3 times I am successfully locked out for 20 seconds however I notice the counter says I failed 4 times even though it's only 3. Also taking note, when inputting the wrong password, the usual message displayed is Invalid password, please try again, in red text and once the system is locked out, the message Account locked due to 4 failed logins, appears in white text.


3. After waiting 20 seconds and inputting the correct password, it still fails me one more time before changing the fail text to the original red text but then unlocking after I put the password in correctly yet again. Furthermore, the account lockout only seems to work on the first login after the system reboot. If I login correctly that once or intentionally fail logging in, afterwards, I will be able to login no matter how many times I fail.

Some forums and blogs say that you also need to put:

account     required     pam_tally2.so

inside the common-account file also

Other forums say to put the the aforementioned line but with all the options that you put in the common-auth file too. Neither of these approaches seem to make pam_tally2 work.

I've also tried experimentally to put

account     required     pam_env.so

inside the common-account file as the first line. This doesn't seem to work or change anything either.

I've tried putting the pam_env.so line above and below the pam_tally2.so in both files in all possible combinations and this doesn't seem to correct the behavior.

If anyone knows why pam_tally2.so isn't working or if it's a bug with Ubuntu please let me know. Thank you for your time.

I had same experience. And I solve it as below.

1. vim [/etc/pam.d/login]
   not the [/etc/pam.d/common-auth]



2. 
   

   Add the following lines.
   auth required pam_tally2.so deny=4 even_deny_root unlock_time=1200

   
   
   
   
   
   • deny=4 (lock the account after 4 failed logins)
   
   
   • even_deny_root (Root account will be locked as well)
   
   
   • unlock_time=1200 (unlocked after 20 minutes)
   
   
   
   


3. 
   

   Reference

   
   
   
   
   
   • My Ubuntu : Ubuntu 16.04.5 LTS
   
   
   • Command : man pam_tally2