Unlock Linux accounts which are locked by PAM_tally2
pam_tally2 module is used to lock user accounts
after certain number of failed ssh login attempts made to the system.
This module keeps the count of attempted accesses and too many failed
attempts.
pam_tally2 module comes in two parts, one is pam_tally2.so and another is pam_tally2. It is based on PAM module and can be used to examine and manipulate the counter file. It can display user login attempts counts, set counts on individual basis, unlock all user counts.
By default, pam_tally2 module is already installed on the most of the Linux distributions and it is controlled by PAM package itself. This article demonstrates on how to lock and unlock SSH accounts after reaching a certain failed number of login attempts.
Open this file and add the following AUTH configuration line to it at beginning of the ‘auth‘ section.
Next, add the following line to ‘account‘ section.
Now, verify or check the counter that user attempts with the following command.
How to reset or unlock the user account to enable access again.
Verify login attempt is reset or unlocked
The PAM module is part of all Linux distribution and configuration provided about should work on all Linux distribution. Do ‘man pam_tally2‘ from the command line to know more about it.
pam_tally2 module comes in two parts, one is pam_tally2.so and another is pam_tally2. It is based on PAM module and can be used to examine and manipulate the counter file. It can display user login attempts counts, set counts on individual basis, unlock all user counts.
By default, pam_tally2 module is already installed on the most of the Linux distributions and it is controlled by PAM package itself. This article demonstrates on how to lock and unlock SSH accounts after reaching a certain failed number of login attempts.
How to Lock and Unlock User Accounts
Use ‘/etc/pam.d/password-auth‘ configuration file to configure login attempts accesses.Open this file and add the following AUTH configuration line to it at beginning of the ‘auth‘ section.
auth required pam_tally2.so file=/var/log/tallylog deny=3 even_deny_root unlock_time=1200
Next, add the following line to ‘account‘ section.
account required pam_tally2.so
Parameters
- file=/var/log/tallylog – Default log file is used to keep login counts.
- deny=3 – Deny access after 3 attempts and lock down user.
- even_deny_root – Policy is also apply to root user.
- unlock_time=1200 – Account will be locked till 20 Min. (remove this parameters if you want to lock down permanently till manually unlock.)
[root@tecmint ~]# ssh tecmint@172.16.25.126 tecmint@172.16.25.126's password: Permission denied, please try again. tecmint@172.16.25.126's password: Permission denied, please try again. tecmint@172.16.25.126's password: Account locked due to 4 failed logins Account locked due to 5 failed logins Last login: Mon Apr 22 21:21:06 2013 from 172.16.16.52
Now, verify or check the counter that user attempts with the following command.
[root@tecmint ~]# pam_tally2 --user=tecmint Login Failures Latest failure From tecmint 5 04/22/13 21:22:37 172.16.16.52
How to reset or unlock the user account to enable access again.
[root@tecmint pam.d]# pam_tally2 --user=tecmint --reset Login Failures Latest failure From tecmint 5 04/22/13 17:10:42 172.16.16.52
Verify login attempt is reset or unlocked
[root@tecmint pam.d]# pam_tally2 --user=tecmint Login Failures Latest failure From tecmint 0
The PAM module is part of all Linux distribution and configuration provided about should work on all Linux distribution. Do ‘man pam_tally2‘ from the command line to know more about it.
Comments
Post a Comment