Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The title says it all. I have my unsuccessful login attempts set to three. I purposefully fail logging in 2x, then when I SSH into the box successfully the 3rd time my count drops back to zero; exactly what should happen. But at the console I get failed login attempts EVEN for my successful login attempts. I am using RHEL 5.6 and no I am not able to upgrade. Here is my system-auth file:

auth    required    pam_env.so
auth    required    pam_tally.so onerr=fail deny=3 per_user
auth    sufficient  pam_unix.so nullok try_first_pass
auth    requisite   pam_succeed_if.so uid >= 500 quiet
auth    required    pam_deny.so

account required    pam_unix.so
account required    pam_tally.so
account sufficient  pam_succeed_if.so uid < 500 quiet
account required    pam_permit.so

password requisite  pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password required   pam_deny.so

session  optional   pam_keyinit.co revoke
session  required   pam_limits.so
session  [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session  required   pam_unix.so

I have tried adding reset after and in place of per_user in the auth required pam_tally.so field. Nothing seems to work and I don't know why SSH is working just fine. Any ideas?

share|improve this question
    
What's in /etc/pam.d/sshd and /etc/pam.d/login? –  MadHatter Sep 30 '13 at 15:01
    
You are using pam_tally. Try pam_tally2 instead - linux-pam.org/Linux-PAM-html/sag-pam_tally2.html –  tdk2fe Sep 30 '13 at 15:23
    
The pam.d/sshd is:auth include system-auth<br> account required pam_nologin.so<br> account include system-auth <br> password include system-auth<br> session optional pam_keyinit.so force revoke<br> session include system-auth<br> session required pam_loginuid.so –  jnbbender Sep 30 '13 at 15:36
    
I tried pam_tally2 also. –  jnbbender Sep 30 '13 at 15:37
    
Let me get you pam.d/login but I gotta figure out how to add breaks in here 1st. –  jnbbender Sep 30 '13 at 15:38

1 Answer 1

Although the question is quite old I still want to answer to this.

account required    pam_tally.so

Has be to specified just after auth required pam_tally.so and before pam_unix.so. In your case it should read

auth    required    pam_env.so
auth    required    pam_tally.so onerr=fail deny=3 per_user
account required    pam_tally.so
auth    sufficient  pam_unix.so nullok try_first_pass
auth    requisite   pam_succeed_if.so uid >= 500 quiet
auth    required    pam_deny.so

account required    pam_unix.so
account sufficient  pam_succeed_if.so uid < 500 quiet
account required    pam_permit.so

password requisite  pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password required   pam_deny.so

session  optional   pam_keyinit.co revoke
session  required   pam_limits.so
session  [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session  required   pam_unix.so
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.