The pam_tally2(8) PAM module can be used to deny access to an account after too many failed login attempts, which sounds like exactly what you want to do. If your current setup is authenticating via PAM
, then this should work just fine.
This article has some configuration examples.
You mention that you've looked at the PAM SAG, which documents pam_tally2
, but you didn't say why it was unhelpful. If you've already looked at this module and decided it doesn't meet your needs, it would help if you update your question to indicate why the various other solutions didn't work out.
Here's an example using the Cyrus SASL2 sasl2-sample-server
and sasl2-sample-client
programs.
In /etc/pam.d/sample
I have:
auth required pam_tally2.so deny=3 unlock_time=300
auth sufficient pam_mysql.so config_file=/etc/pam_mysql.conf
auth required pam_deny.so
account required pam_mysql.so config_file=/etc/pam_mysql.conf
And /etc/pam_mysql.conf
looks like this:
users.database=pamuser
users.table=pamuser
users.db_user=pamuser
users.db_passwd=pamuser
users.user_column=user
users.password_column=password
users.password_crypt=plain
verbose=1
I have a database pamuser
with a table pamuser
that looks like this:
mysql> select * from pamuser;
+------+----------+
| user | password |
+------+----------+
| lars | lars |
+------+----------+
In /etc/sasl2/sample.conf
I have:
pwcheck_method: saslauthd
mech_list: plain
I start saslauthd
like this:
saslauthd -a pam
I start sasl2-sample-server
:
sasl2-sample-server -p 9999 -m plain -s sample
And I try authenticate using sasl2-sample-client
, first using the correct password:
$ sasl2-sample-client -p 9999 localhost
receiving capability list... recv: {5}
plain
plain
please enter an authentication id: lars
please enter an authorization id: lars
Password:
send: {5}
PLAIN
send: {1}
Y
send: {14}
lars[0]lars[0]lars
successful authentication
closing connection
Great, that worked. Now I'm going to enter the wrong password three times...
...okay, that was quick. Now pam_tally2
shows the failures:
# pam_tally2
Login Failures Latest failure From
lars 3 07/31/13 12:17:00 unknown
And if I log in using the correct password again, I get rejected:
$ sasl2-sample-client -p 9999 localhost
.
.
.
lars[0]lars[0]lars
authentication failed
closing connection
pam_tally2
logs the following:
Jul 31 12:18:01 madhatter saslauthd[14122]: pam_tally2(sample:auth): user lars (1000) tally 4, deny 3
And the pam_tally2
command shows an increased failure count:
# pam_tally2
Login Failures Latest failure From
lars 4 07/31/13 12:18:01 unknown
And there you have it, a complete example of integrating pam_tally2
and pam_mysql
. If I were to wait five minutes, or run pam_tally2 -u lars -r
, I would be able to log in again.