Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
failed login counter is not cleared upon successful login
Version-Release number of selected component (if applicable):
rhel6
rpm -qa |grep pam
gnome-keyring-pam-2.28.2-6.el6.x86_64
pam_ssh_agent_auth-0.9-20.el6_0.3.x86_64
pam-1.1.1-4.el6_0.1.x86_64
pam-devel-1.1.1-4.el6_0.1.x86_64
pam_krb5-2.3.11-1.el6.x86_64
pam_passwdqc-1.0.5-6.el6.x86_64
nss-pam-ldapd-0.7.5-3.el6.x86_64
pam_ldap-185-5.el6.x86_64
pam_pkcs11-0.6.2-10.el6.x86_64
fprintd-pam-0.1-19.git04fd09cfa.el6.x86_64
How reproducible:
every time
Steps to Reproduce:
1.set pam_tally in /etc/pam.d/system-auth:
auth required pam_env.so
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth required pam_tally2.so deny=5 audit unlock_time=60
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account required pam_unix.so
account required pam_tally2.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password requisite pam_passwdqc.so min=disabled,disabled,disabled,12,12 passphrase=0 similar=permit match=0
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=24
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.
2. su - testuser with bad password a few times. su - testuser with correct password and authenticate. then su - testuser with bad password again. The testuser account will lock out based on the total number of incorrect logins since the beginning of the test, not since correct login.
Actual results:
Expected results:
tallylog to count from last good login, not since beginning/ last cleared
Additional info:
my test:
I built a test login and over 15 minutes, i failed to authenticate 6 times so the account locked. What is interesting - and incorrect- is that in that time frame between the incorrect login I did successfully login several times, so the pam_tally2 counter should have been reset.
Basically, my pattern was this:
su - test
bad password
su - test
bad password
su - test
correct password and successful login
su -test
bad password
su -test
correct password and successful login
su - test
bad password
su - test
bad password
su - test
correct password and successful login
su -test
bad password
account locked for 15 minutes.
--------------------------
after this, when the lockout time expires, the tallylog still shows the 6 bad, so I get this:
su - test
correct password and successful login
su - test
bad password
su - test
bad password
Account locked due to 8 failed logins