[SOLVED] ssh faillock

thomasbb · 2021-07-21 07:12:16

The steps are:
1. create a user with useradd
2. try to ssh with a fake password three times to have a Permission denied error
3. set a password to the user
4. retry to ssh with the right password: it should fail no matter what password is set

The new attempts to connect with ssh fail forever afterwards. Is it just me? On two users, I observed the same behavior.

If the password is set before the ssh attempt or if a fake password is not given three times, then ssh works as expected

Last edited by thomasbb (2021-07-21 14:13:31)

seth · 2021-07-21 07:13:42

https://wiki.archlinux.org/title/Securi … n_attempts

thomasbb · 2021-07-21 11:55:29

But a su login works though...

WorMzy · 2021-07-21 11:59:30

ArchWiki wrote:

The lockout only applies to password authentication

thomasbb · 2021-07-21 12:02:12

Here I have the opposite issue: the ssh login never works afterwards, but the su login goes well. If I understood the wiki well, it describes the situation where the user is locked out for login but ssh still works

seth · 2021-07-21 13:07:28

wiki wrote:

public key authentication over SSH is still accepted

Do you have a faillock entry and whyt happens when you reset it?

thomasbb · 2021-07-21 13:31:31

What I do is:

not initializing a password to the newly created user:
1. create a user myuser, without setting a password with passwd to this myuser
2. ssh myuser@localhost
3. type 3 times a fake string
4. set a password with passwd
5. ssh myuser@localhost doesn't work
6. su myuser works
initializing a password to the newly created user:
1. create a user myuser, set password with passwd to this myuser
2. both ssh and su work with the set password

In either case, no key identification.

To summarize, if the password hasn't been set, the ssh command never recovers (or maybe after a timeout). It seems the wiki describes the opposite situation: the user is locked out but ssh still works

seth · 2021-07-21 13:33:46

It seems the wiki describes the opposite situation

No. Look at the goddamn faillock list and try to reset it, will you? Please?

schard · 2021-07-21 13:35:41

You're still describing the intended behavior.
The faillock is applied depending on context.
SSH results in an RHOST lock:

# faillock
test:
When                Type  Source                                           Valid
2021-07-21 09:36:45 RHOST ::1                                                  V
2021-07-21 09:36:51 RHOST ::1                                                  V
2021-07-21 09:36:55 RHOST ::1                                                  V

While the local login results in a TTY lock:

# faillock
test:
When                Type  Source                                           Valid
2021-07-21 15:34:03 TTY   /dev/tty3                                            V
2021-07-21 15:34:10 TTY   /dev/tty3                                            V
2021-07-21 15:34:17 TTY   /dev/tty3                                            V

Edit: Ninja'd

Last edited by schard (2021-07-21 13:36:44)

thomasbb · 2021-07-21 14:11:14

schard wrote:

The faillock is applied depending on context.

Of course, my bad... Thank you for giving it a try

Arch Linux

#1 2021-07-21 07:12:16

[SOLVED] ssh faillock

#2 2021-07-21 07:13:42

Re: [SOLVED] ssh faillock

#3 2021-07-21 11:55:29

Re: [SOLVED] ssh faillock

#4 2021-07-21 11:59:30

Re: [SOLVED] ssh faillock

#5 2021-07-21 12:02:12

Re: [SOLVED] ssh faillock

#6 2021-07-21 13:07:28

Re: [SOLVED] ssh faillock

#7 2021-07-21 13:31:31

Re: [SOLVED] ssh faillock

#8 2021-07-21 13:33:46

Re: [SOLVED] ssh faillock

#9 2021-07-21 13:35:41

Re: [SOLVED] ssh faillock

#10 2021-07-21 14:11:14

Re: [SOLVED] ssh faillock

Board footer