Arch Linux

freebe

Member

From: Germany

Registered: 2015-10-29

Posts: 41

pam_tally 2 -> set a period of time for "deny"

Dear Archies,
I went back to windows, as something that "just works" and where I'm able to play my precious games... Well, until I got a bluescreen yesterday and something in my mind clicked. I spent the whole night installing Arch, setting up encryption, LVM etc. This time I want to do it right!

I followed the wiki article on Security to create a lockout after three failed login attempts.

These are the parameters I used:

auth       required   pam_tally2.so        deny=3        unlock_time=600 onerr=succeed

I would like to set it up in a way, that I can specify a timespan in which these wrong logins have to happen to lead to a lockout. Because at the moment the counter just counts until the failed attempts have accumulated. Even after hours... I'm not clear yet if the counter persists through reboots.

Is that possible?

When I was searching, I found "pam_shield" on git, but that was for remote logins, also this package was not updated since 2012... So I think that is not the solution.

Thank you, live long and prosper!

x33a

Forum Fellow

Registered: 2009-08-15

Posts: 4,587

Re: pam_tally 2 -> set a period of time for "deny"

I don't have any experience with this module, but  a look at its documentation indicates that there is no option to set a period to consider for failed auths.

That said, there is a program called pam_tally2, which can be used to manipulate the counter. So, you should be able to run it at certain intervals to manipulate the counter file any way that you want.

freebe

Member

From: Germany

Registered: 2015-10-29

Posts: 41

Re: pam_tally 2 -> set a period of time for "deny"

That's a nice idea to work around.

So I would need to run "pam_tally2 -u username --reset" every half an hour or hour. At the moment I have no Idea how to do that, but I'll dig into it when the more pressing issues with my system are solved.

When it's done, I'm going to post an update here.

circleface

Member

Registered: 2012-05-26

Posts: 639

Re: pam_tally 2 -> set a period of time for "deny"

systemd timers are great for running a task like that. https://wiki.archlinux.org/index.php/Systemd/Timers for more information.

Edit: added link to wiki

Last edited by circleface (2018-01-12 04:15:08)