2

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt fails, saslauthd reports "saslauthd: pam_mysql - SELECT returned no result."

However, once in a while I get dictionary attacks, and although those attacks have never succeeded, I would like to limit the sasl/pam_mysql retries.

Note that I don't want to limit the number of client sessions nor connections. The goal is to cap the maximum failed login attempts per email.

Some, but not limited to, sources I've tried

  • www.postfix.org/SASL_README.html#saslauthd_pam
  • www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html
  • Limiting Failed SSH Logins
  • www.lehman.cuny.edu/cgi-bin/man-cgi?pam_sm_authenticate+3
2
  • For clarity, I'm looking for a way to integrate pam_mysql and pam_tally2 or pam_tally. Please, do not give me examples of pam_tally and SSH.
    – msantos
    Jul 31, 2013 at 15:24
  • I've updated my answer with a complete example.
    – larsks
    Jul 31, 2013 at 16:59

1 Answer 1

1

The pam_tally2(8) PAM module can be used to deny access to an account after too many failed login attempts, which sounds like exactly what you want to do. If your current setup is authenticating via PAM, then this should work just fine.

This article has some configuration examples.

You mention that you've looked at the PAM SAG, which documents pam_tally2, but you didn't say why it was unhelpful. If you've already looked at this module and decided it doesn't meet your needs, it would help if you update your question to indicate why the various other solutions didn't work out.

Here's an example using the Cyrus SASL2 sasl2-sample-server and sasl2-sample-client programs.

In /etc/pam.d/sample I have:

auth        required    pam_tally2.so deny=3 unlock_time=300
auth        sufficient    pam_mysql.so config_file=/etc/pam_mysql.conf
auth        required      pam_deny.so

account required pam_mysql.so config_file=/etc/pam_mysql.conf

And /etc/pam_mysql.conf looks like this:

users.database=pamuser
users.table=pamuser
users.db_user=pamuser
users.db_passwd=pamuser
users.user_column=user
users.password_column=password
users.password_crypt=plain
verbose=1

I have a database pamuser with a table pamuser that looks like this:

mysql> select * from pamuser;
+------+----------+
| user | password |
+------+----------+
| lars | lars     |
+------+----------+

In /etc/sasl2/sample.conf I have:

pwcheck_method: saslauthd
mech_list: plain

I start saslauthd like this:

saslauthd -a pam

I start sasl2-sample-server:

sasl2-sample-server -p 9999 -m plain -s sample

And I try authenticate using sasl2-sample-client, first using the correct password:

$ sasl2-sample-client -p 9999 localhost
receiving capability list... recv: {5}
plain
plain
please enter an authentication id: lars
please enter an authorization id: lars
Password: 
send: {5}
PLAIN
send: {1}
Y
send: {14}
lars[0]lars[0]lars
successful authentication
closing connection

Great, that worked. Now I'm going to enter the wrong password three times...

...okay, that was quick. Now pam_tally2 shows the failures:

# pam_tally2
Login           Failures Latest failure     From
lars                3    07/31/13 12:17:00  unknown

And if I log in using the correct password again, I get rejected:

$ sasl2-sample-client -p 9999 localhost
.
.
.
lars[0]lars[0]lars
authentication failed
closing connection

pam_tally2 logs the following:

Jul 31 12:18:01 madhatter saslauthd[14122]: pam_tally2(sample:auth): user lars (1000) tally 4, deny 3

And the pam_tally2 command shows an increased failure count:

# pam_tally2
Login           Failures Latest failure     From
lars                4    07/31/13 12:18:01  unknown

And there you have it, a complete example of integrating pam_tally2 and pam_mysql. If I were to wait five minutes, or run pam_tally2 -u lars -r, I would be able to log in again.

4
  • PAM SAG wasn't helpful because it doesn't document how to integrate pam_tally2 and pam_mysql
    – msantos
    Jul 31, 2013 at 15:22
  • Well, the example configuration sections show how to stack PAM modules. And your local system configuration probably has some good examples in /etc/pam.d. There's nothing special about pam_mysql. The pam_tally2 man page has some examples that look pretty thorough -- just replace pam_unix, for example, with pam_mysql (and, you know, ignore stuff that's not relevant to your particular application).
    – larsks
    Jul 31, 2013 at 15:24
  • Replacing pam_unix with pam_mysql in those examples, was the first thing I tried. Actually tried, several ways but none worked. The catch here is pam_mysql + pam_tally
    – msantos
    Jul 31, 2013 at 15:28
  • In that case, I point you towards the second half of my answer...if you can show us what you tried and how it failed (log messages, errors, behavior, etc), we can probably provide better answers.
    – larsks
    Jul 31, 2013 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .