Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local.

I need to lock users out after N failed password logins.

The examples in man pam_tally2 and pam_faillock do not lock a user using ssh out. The pam_tally2 example can lock a telnet (I enabled to test) login & subsequently will lock an ssh user out. ssh cannot trigger it.

/etc/ssh/sshd_config has:

PasswordAuthentication yes # setting to no doesn't allow login with a password!
UsePAM yes
UseLogin no # setting to yes doesn't allow putty logins

Man page examples should work on an unaltered system.

share|improve this question
    
This doesn't answer your question directly, but, try fail2ban. (It's in EPEL.) –  mattdm Feb 12 '13 at 1:19
add comment

1 Answer

If you enable PasswordAuthentication then the SSH daemon handles passwords itself and not using PAM. You actually want to disable this in order to force it to use PAM:

PasswordAuthentication no
UsePAM yes
ChallengeResponseAuthentication yes

That won't catch users using keys however (although personally I think that's fine). If you do you'll probably have to use something like fail2ban which looks for authentication failures in the logs and adds iptables rules to block future attempts.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.