<html><body><div>Hi Tomas,</div><div><br></div><div>Thanks again for your help.</div><div><br></div><div>On Jun 06, 2013, at 01:44 PM, Tomas Mraz <tmraz@redhat.com> wrote:<br><br></div><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch">On Thu, 2013-06-06 at 18:24 +0000, Bryan Harris wrote: <br> > <br> > I have removed the 3rd line, and I have placed the account line at the<br> > beginning of the account section. For some reason now, faillock does<br> > not increment new failures for my users. Any ideas?<br> I'd have to see your current PAM config to tell. Also you need to<br> examine the failures before you login successfully with that user -<br> because the account required pam_faillock.so will reset the failures<br> once the user successfully authenticates.</div></div></blockquote><span> </span></div><div>In my file below, I changed the sssd line back to sufficient instead of the stuff I had placed in it before. When I do a failed login for my sssd account, it does not any longer increment the counter for me (Yay!).</div><div><span><br></span></div><div><span>However, in my testing, I'm trying to login as root but the counter is not incrementing. I've tried both using ssh as well as using the consoles. Each time I just type a bunch of wrong letters for my root user password, but my counters don't change. In fact I don't even see the root counter any more. I wonder if I've broken the faillock mechanism...?</span></div><div><span><br></span></div><div><span><div>#%PAM-1.0</div><div># This file is auto-generated.</div><div># User changes will be destroyed the next time authconfig is run.</div><div>auth required pam_env.so</div><div>auth requisite pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=900</div><div>auth sufficient pam_fprintd.so</div><div>auth sufficient pam_unix.so try_first_pass</div><div>auth requisite pam_succeed_if.so uid >= 500 quiet</div><div>auth sufficient pam_sss.so use_first_pass</div><div>auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=900 fail_interval=900</div><div>auth required pam_deny.so</div><div><br></div><div>account required pam_faillock.so</div><div>account required pam_unix.so</div><div>account sufficient pam_localuser.so</div><div>account sufficient pam_succeed_if.so uid < 500 quiet</div><div>account [default=bad success=ok user_unknown=ignore] pam_sss.so</div><div>account required pam_permit.so</div><div><br></div><div>password requisite pam_cracklib.so try_first_pass retry=3 type= dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4 maxrepeat=3</div><div>password sufficient pam_sss.so use_authtok</div><div>password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember=24</div><div>password required pam_deny.so</div><div><br></div><div>session optional pam_keyinit.so revoke</div><div>session required pam_limits.so</div><div>session optional pam_oddjob_mkhomedir.so</div><div>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session required pam_unix.so</div><div>session optional pam_sss.so</div></span></div><div><div><pre data-mce-style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap;" style="font-family: Helvetica, Arial, sans-serif; white-space: pre-wrap;">Bryan</pre></div></div></body></html>