0

I have been using pam_tally2 to lock a user after certain number of failed attempts through ssh

In /etc/pam.d/common-auth

auth required pam_tally2.so deny=3 unlock_time=600 

In /etc/pam.d/common-account

account required pam_tally2.so

I have to tried to login through ssh,3 failed attempts is working fine not sure whether it is because of this deny=3 or MAxAUthtries in sshd_config.

Also pam_tally2 -u test is showing 0.

Can u help me on this issue?

0

The pam_tally2 configuration you have is what is locking out your bad attempts.

deny will:

Deny access if tally for this user exceeds n.

From the documentation MaxAuthTries only locks out connections.

Specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6.

This would be circumvented by creating a ssh new connection.

I am not sure why pam_tally2 -u blah would show zero unless you've had a successful login and/or you've reached the reset time of ten minutes you have configured.

References

sshd_config man page

pam_tally2 man page

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.