[Solved] How to configure 3 bad login attempts 10min lockout?

Maniaxx · 2020-08-19 21:41:46

Hallo,
when i switch to tty2 and enter my credentials 3 times wrong it results in a 10 minutes lockout. When i switch back to tty1 (that is logged in into xfce already) and try to 'sudo <something>' it doesn't work until the lockout time is over.

How can i configure this? I want more possible attempts and less lockout time. I've already looked up /etc/pam.d but couldn't find anything that matches this. I'm not using any tally module either as far as i know. I login with startx.

The actual issue i had was a bad xscreensaver behavior where it didn't show anything on the lockscreen so i hammered the keyboard. Then suddenly it came back showing me i'm locked out for 10 minutes. I switched to tty2 as root and killed xscreensaver and everything looked fine until i noticed that sudo was still blocked.

/etc/pam.d/system-login:

#%PAM-1.0

auth       required   pam_shells.so
auth       requisite  pam_nologin.so
auth       include    system-auth

account    required   pam_access.so
account    required   pam_nologin.so
account    include    system-auth

password   include    system-auth

session    optional   pam_loginuid.so
session    optional   pam_keyinit.so       force revoke
session    include    system-auth
session    optional   pam_motd.so          motd=/etc/motd
session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
-session   optional   pam_systemd.so
session    required   pam_env.so           user_readenv=1

/etc/pam.d/system-auth:

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
auth       [success=2 default=ignore]  pam_unix.so          try_first_pass nullok
-auth      [success=1 default=ignore]  pam_systemd_home.so
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.

-account   [success=1 default=ignore]  pam_systemd_home.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

-password  [success=1 default=ignore]  pam_systemd_home.so
password   required                    pam_unix.so          try_first_pass nullok shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    optional                    pam_permit.so

Last edited by Maniaxx (2020-08-19 22:33:11)

demaio · 2020-08-19 21:57:22

There is a PAM module called pam_faillock in /etc/pam.d/system-auth. The manpage should have all the information you need to configure it.

Maniaxx · 2020-08-19 22:31:09

Thanks. It's /etc/security/faillock.conf.

felixfontein · 2020-08-22 19:39:17

@Maniaxx did you happen to find out what is causing the problems with xscreensaver? I'm currently having the same problems since a couple of days. It cannot be the xscreensaver package itself, since that hasn't changed since end of March. Since I'm using xfce4, I've now switched to xfce4-screensaver, which doesn't seem to have this problem.

Maniaxx · 2020-08-23 22:14:32

It just happened once so far. Currently its working properly.

graysky · 2020-08-31 11:27:00

@Maniaxx - What did you change to cause it to work fine? You marked the thread as solved.

Maniaxx · 2020-08-31 13:04:23

The values can be changed in the config file i mentioned earlier. I don't have the file in front of me right now but the options should be obvious.

I just want to prevent the lockout by increasing the possible attempts not the sudo behavior when you're locked out.

Last edited by Maniaxx (2020-08-31 13:08:18)

Arch Linux

#1 2020-08-19 21:41:46

[Solved] How to configure 3 bad login attempts 10min lockout?

#2 2020-08-19 21:57:22

Re: [Solved] How to configure 3 bad login attempts 10min lockout?

#3 2020-08-19 22:31:09

Re: [Solved] How to configure 3 bad login attempts 10min lockout?

#4 2020-08-22 19:39:17

Re: [Solved] How to configure 3 bad login attempts 10min lockout?

#5 2020-08-23 22:14:32

Re: [Solved] How to configure 3 bad login attempts 10min lockout?

#6 2020-08-31 11:27:00

Re: [Solved] How to configure 3 bad login attempts 10min lockout?

#7 2020-08-31 13:04:23

Re: [Solved] How to configure 3 bad login attempts 10min lockout?

Board footer