I'm trying to implement an account lockout after 3 fail sign-on attempt. Root is exempted.
Here's what I have in my /etc/pam.d/system-auth file so far
auth required pam_tally2.so deny=3 onerr=fail magic_root account required pam_tally2.so
On my /etc/pam.d/sshd file, I have added the following line
auth required pam_tally2.so deny=3 onerr=fail magic_root
However this does not work. I have tried logging in via SSH with a test non-root user and wrong password but it does not lock me out.
However, if I tweak the /etc/pam.d/sshd file and remove the magic_root line, like so:
auth required pam_tally2.so deny=3 onerr=fail
The test account will lock out.
Am I missing something out there?
Also, could someone please explain the difference between /etc/pam.d/system-auth and /etc/pam.d/password-auth? Should settings like these goes into system-auth or password-auth? Thanks