Bug 2030043

(In reply to Adrian Soliard from comment #0)
> I note that, by default, RHEL8 does not show those mesage, so modifying the
> postlogin PAM stack to
> look like the RHEL7 one, but it doesn't works.
> _____________________________________________________________________________
> ______________
> 
> RHEL7
> 
>     cat /etc/redhat-release ;cat /etc/pam.d/postlogin
>     Red Hat Enterprise Linux Server release 7.9 (Maipo)
>     #%PAM-1.0
>     # This file is auto-generated.
>     # User changes will be destroyed the next time authconfig is run.
>     
>     
>     session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm*
> service !~ su* quiet
>     session     [default=1]   pam_lastlog.so nowtmp showfailed
>     session     optional      pam_lastlog.so silent noupdate showfailed
> 
> RHEL8
> 
>     cat /etc/redhat-release ;cat /etc/pam.d/postlogin 
>     Red Hat Enterprise Linux release 8.4 (Ootpa)
>     # Generated by authselect on Tue Dec  7 14:14:26 2021
>     # Do not modify this file manually.
>     
>     #session     optional                   pam_umask.so silent
>     session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm*
> service !~ su* quiet
>     #session     [default=1]                pam_lastlog.so nowtmp silent
>     session     [default=1]                pam_lastlog.so nowtmp showfailed
>     session     optional                   pam_lastlog.so silent noupdate
> showfailed

Your assumption to change the pam stack is correct. I also changed it and in the last successful authentication after several failed attempts, I was able to see the following message on the screen: "Last login: Wed Dec 15 16:25:10 CET 2021 on tty2". If you follow the same steps with ssh, that is to say, several failed authentication attempts and then the last one is successful:
$ ssh testuser@localhost
Last failed login: Wed Dec 15 16:19:34 CET 2021 from ::1 on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Wed Dec 15 16:19:14 2021 from ::1

The second message is the expected one. Curiously, the last message from ssh is the one that appears on the gnome login screen. So, I wonder, is that screen able to show several messages at the same time? Or does it only show the last one? Since it seems to work with other tools I think that the problem lies on the desktop environment, so I'm moving the bugzilla to that team. If you have any question don't hesitate to contact me.

> Additional info:
> 
> I recreated the case with RHEL8.4. The issue was discovered using RHEL8.3

I was able to reproduce it with RHEL8.2.

Testing Procedure: [ Test failed Text Console Login display in subsequent Gnome Login ]

On a freshly instanced RHEL 7/8 system that has a GUI ( Gnome Installed and active ) : 

1. Attempt Login via text mode to normal user ( shadowman ) using [ Ctrl + Alt + F2 ] for text console and use deliberately incorrect password.

2. Once it fails, press [ Ctrl + Alt + F1 ] to bring up the GUI and login as same user using correct password into GUI: 

3. System SHOULD show the failed login in the GUI Screen, It does in RHEL 7, but not in RHEL 8.



Test Results: 

RHEL 7.9:   This is the baseline Comparison

[ Messages Displayed: ]

Last Login: ( Date + Time )
Last Failed Failed - ( Date + Time = Terminal ( tty2) 
There has been 1 Failed login attempt since last login



RHEL 8.0 
[ No Notices were displayed ]

RHEL 8.1
[ No Notices were displayed ]

RHEL 8.2
[ No Notices were displayed ]

RHEL 8.3
[ No Notices were displayed ]

RHEL 8.4
[ No Notices were displayed ]

RHEL 8.5
[ No Notices were displayed ]


Note: I have not tested the ssh failed logins and Gnome failed logins yet, but plan on doing so.

I have completed another set of tests, this time using SSH logins that have failed: 



Testing Procedure: [ Test failed SSH Login display in subsequent Gnome Login ]

On a freshly instanced RHEL 7/8 system that has a Gnome Installed and active: 

1. Attempt Login via text mode to normal user ( shadowman ) using inbound SSH and use deliberately incorrect password.

2. Once it fails, login as same user using correct password into GUI: 

3. System SHOULD show the failed login in the GUI Screen, It does in RHEL 7, but not in RHEL 8.



Test Results: 

RHEL 7.9:   This is the baseline Comparison

[ Messages Displayed: ]

Last Login: ( Date + Time )
Last Failed Failed - ( Date + Time = Terminal ( ssh ) 
There has been 1 Failed login attempt since last login

Testing Note: This Time I am only Testing RHEL 8.0 , 8.4 , and 8.5 as previous test indicates it goes back to RHEL 8.0 and most current RHEL is 8.4/8.5

RHEL 8.0 
[ No Notices were displayed ]

RHEL 8.4
[ No Notices were displayed ]

RHEL 8.5
[ No Notices were displayed ]

So it seems to show the message on the graphical login screen, if a failed login happens at a virtual terminal.

This suggests to me that perhaps gdm is failing to write a btmp record for failed log ins.

A quick peek of the code:

#if defined(HAVE_UPDWTMPX)•
        updwtmpx (GDM_BAD_SESSION_RECORDS_FILE, &session_record);•
#elif defined(HAVE_UPDWTMP)•
        updwtmp(GDM_BAD_SESSION_RECORDS_FILE, &session_record);•
#endif•

So perhaps those defines aren't getting set since we switched to the meson build system? just a guess, will need to investigate further.

re comment 3, what does your /etc/pam.d/postlogin file look like ? is it the same as the one mentioned in comment 0?

[root@rhel8test ~]# ll /etc/pam.d/postlogin
lrwxrwxrwx. 1 root root 25 Jan 10 08:17 /etc/pam.d/postlogin -> /etc/authselect/postlogin

[root@rhel8test ~]# ll /etc/authselect/postlogin
-rw-r--r--. 1 root root 397 Jan 10 08:17 /etc/authselect/postlogin

[root@rhel8test ~]# cat /etc/authselect/postlogin
# Generated by authselect on Mon Jan 10 08:17:01 2022
# Do not modify this file manually.

session optional pam_umask.so silent
session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session [default=1] pam_lastlog.so nowtmp showfailed
session optional pam_lastlog.so silent noupdate showfailed

This issue the btmp record as noted in comment 4.  If you fails logins at the terminal or ssh, the failures are correctly showed in GDM during login.

So from poking around a little, this doesn't seem to be a build system problem after all. It's a regression caused by switching to user sessions on a different tty than the login screen.

The problem is, I believe, that the login screen's session isn't ever assigned it's display name. The display name is needed to write a btmp record.

gdm_manager_handle_register_display only looks for user sessions. it needs to look for login screen sessions as well I think.

This is a regression of the NIST 800-53 AC-9(1) security control:
  The information system notifies the user, upon successful logon/access, of the number of 
  unsuccessful logon/access attempts since the last successful logon/access.

This needs to be fixed for government customers needing to adhere to NIST & DISA STIG standards.

I can easily reproduce the issue on 8.7 (thanks for the well written bug report). Adding necessary ack, etc.

Created attachment 1919147 [details]
patch to fix btmp accounting

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (gdm bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2779