up vote 2 down vote favorite
share [g+] share [fb]

I am trying to implement account lockout for Ubuntu systems using pam_tally. The login should be disabled for certain interval on 3 invalid login attempts. This should happen for both system and LDAP logins to the system.

(We have a working LDAP central authentication system where users from Ubuntu clients can authenticate)

How can we configure this ? I could see some articles on this for redhat but not ubuntu

link|improve this question
72% accept rate
PAM is a standard system, you should find it similar across not just Linux but to Solaris and the BSD's. – Steve-o Aug 30 '11 at 6:05
It might be similar, but the PAM config files are all different – nitins Aug 30 '11 at 18:33
feedback

1 Answer

up vote 4 down vote

If you have pam_tally configured already, you just need to add it to your /etc/pam.d/common-auth directory. Failed logins from LDAP should appear--to PAM--as the same as failed logins against your local machine. So just make sure you get the ordering correct:

auth        required      /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root
account     required      /lib/security/$ISA/pam_tally.so per_user deny=5 no_magic_root reset

(Adapt paths as necessary)

(source)

link|improve this answer
Thats for Redhat I think. No /etc/pam.d/system-auth file in ubuntu – nitins Aug 30 '11 at 12:25
Sorry, on Ubuntu its named "common-auth", but it serves the same function. – Andrew M. Aug 31 '11 at 1:15
Thanks Redmumba , but I have already tried something like this. May be my ordering is wrong. I dont understand PAM properly to order it correctly. Any reference for PAM ? – nitins Aug 31 '11 at 4:50
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.