Bug 2126648

+++ This bug was initially created as a clone of Bug #2082442 +++

Description of problem:

pam_faillock prints "Consecutive login failures for user root account temporarily locked" without even_deny_root

pam_faillock/faillock.conf contains default configuration. e.g. both even_deny_root and root_unlock_time are commented out.

When `root` deliberately authenticate with incorrect password, below error message is logged in /var/log/secure although the account is not actually locked.

   "Consecutive login failures for user root account temporarily locked" 

After this error message is recorded in /var/log/secure, root is able to login successfully with correct password.

~~~
root@node-0 ~]# su - jane
Last login: Fri May  6 16:51:21 AEST 2022 on pts/1
[jane@node-0 ~]$ su -
Password: 
su: Authentication failure
[jane@node-0 ~]$ su -
Password: 
su: Authentication failure
[jane@node-0 ~]$ su -
Password: 
su: Authentication failure
[jane@node-0 ~]$ su -
Password: 
su: Authentication failure
[jane@node-0 ~]$ su -
Password: 
Last login: Fri May  6 16:51:54 AEST 2022 on pts/1
Last failed login: Fri May  6 16:54:57 AEST 2022 on pts/1
There were 4 failed login attempts since the last successful login.
[root@node-0 ~]# 
~~~

Corresponding log message:

~~~
May  6 02:54:34 node-0 su[34095]: pam_systemd(su-l:session): Cannot create session: Already running in a session or user slice
May  6 02:54:34 node-0 su[34095]: pam_unix(su-l:session): session opened for user jane by quicklab(uid=0)
May  6 02:54:41 node-0 unix_chkpwd[34121]: password check failed for user (root)
May  6 02:54:41 node-0 su[34119]: pam_unix(su-l:auth): authentication failure; logname=quicklab uid=1002 euid=0 tty=pts/1 ruser=quicklab rhost=  user=root
May  6 02:54:45 node-0 unix_chkpwd[34124]: password check failed for user (root)
May  6 02:54:45 node-0 su[34122]: pam_unix(su-l:auth): authentication failure; logname=quicklab uid=1002 euid=0 tty=pts/1 ruser=quicklab rhost=  user=root
May  6 02:54:50 node-0 unix_chkpwd[34127]: password check failed for user (root)
May  6 02:54:50 node-0 su[34125]: pam_unix(su-l:auth): authentication failure; logname=quicklab uid=1002 euid=0 tty=pts/1 ruser=quicklab rhost=  user=root
May  6 02:54:50 node-0 su[34125]: pam_faillock(su-l:auth): Consecutive login failures for user root account temporarily locked
May  6 02:54:55 node-0 unix_chkpwd[34130]: password check failed for user (root)
May  6 02:54:55 node-0 su[34128]: pam_unix(su-l:auth): authentication failure; logname=quicklab uid=1002 euid=0 tty=pts/1 ruser=quicklab rhost=  user=root
May  6 02:55:02 node-0 su[34131]: pam_systemd(su-l:session): Cannot create session: Already running in a session or user slice
May  6 02:55:02 node-0 su[34131]: pam_unix(su-l:session): session opened for user root by quicklab(uid=1002)
~~~

To be clear, this ticket reports incorrect log message recorded in /var/log/secure. The behaviour is working as expected. i.e. root account is not locked after consecutive login failure.

Version-Release number of selected component (if applicable):

# rpm -qa | grep pam
pam-1.3.1-14.el8.x86_64
systemd-pam-239-45.el8.x86_64

~~~
# cat password-auth 
# Generated by authselect on Fri May  6 12:03:23 2022
# Do not modify this file manually.

auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        required                                     pam_faillock.so preauth silent
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        [default=1 ignore=ignore success=ok]         pam_localuser.so
auth        sufficient                                   pam_unix.so nullok try_first_pass
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_faillock.so authfail
auth        required                                     pam_deny.so

account     required                                     pam_faillock.so
account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_usertype.so issystem
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required                                     pam_permit.so
<...>
~~~

~~~
[root@node-0 pam.d]# cat system-auth 
# Generated by authselect on Fri May  6 12:03:23 2022
# Do not modify this file manually.

auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        required                                     pam_faillock.so preauth silent
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        [default=1 ignore=ignore success=ok]         pam_localuser.so
auth        sufficient                                   pam_unix.so nullok try_first_pass
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_faillock.so authfail
auth        required                                     pam_deny.so

account     required                                     pam_faillock.so
account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_usertype.so issystem
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required                                     pam_permit.so

<...>
~~~

How reproducible:
100% all the time

Actual results:
"Consecutive login failures for user root account temporarily locked" is recorded in /var/log/secure.

Expected results:
If "even_deny_root" option is not enabled (i.e. pam_faillock will not deny root), then, below log message should not be logged:

   "Consecutive login failures for user root account temporarily locked"

Additional info:

--- Additional comment from Iker Pedrosa on 2022-05-06 10:45:57 UTC ---

You are right, that message shouldn't be printed when the root account can't be locked due to the configuration options.