pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

[Darren Tucker]

On Sun, Mar 05, 2006 at 11:30:57AM -0500, Stewart Adam wrote:
> /etc/pam.d/systam-auth file:
> -- start --
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        required      pam_deny.so

[...]
> Do I have to change them to "Required"?

Just blindly changing "sufficient" to "required" won't do what you
want since the "required pam_deny.so" will mean that you will end up
disallowing all authentications.

> Or would I be able to make it so that I tell my system to use pam_tally
> for everything, but it will only block SSH?

The safest thing to do is probably constructing a sshd PAM config
file that does what you want starting with a copy of system-auth.
Something like this for the auth section ought to work (untested):

auth        required      pam_env.so
auth        required      pam_unix.so nullok try_first_pass
auth        required      pam_tally.so
auth        requisite     pam_succeed_if.so uid >= 500 quiet

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.