Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then).

Is it doable?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You can use the pam_succeed_if module in your stack to provide exceptions for some users. Check the pam_succeed_if(8) manpage for in-depth explanation of the syntax. An example would be:

auth [success=1 default=ignore] pam_succeed_if.so gid eq 2000
auth required                   pam_tally2.so deny=5 onerr=fail unlock_time=1200

That means, if the pam_succeed_if test returns successfully, i.e., for all users in the group whose GID is 2000, skip the following test (pam_tally2); if the test returns failure, ignore it and continue.

Several pam_succeed_if tests can be stacked up for fine-grained control.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.