关于pam、tally2、faillock模块的记录_pam_faillock和tally2.so

1、
Make sure the counter is set to zero
Attempt deny number of logins using wrong password, so the account is locked.
Wait for unlock_time
check the counter using pam_tally2, it shows the number of failures instead of zero.

2、
The problem with /etc/pam.d/system-auth is that it contains modules that are not usable in remote configurations so remote services such as sshd, vsftpd now use /etc/pam.d/password-auth.

3、pam_tally2计数器
pam_tally2 does not reset the counter immediately after unlock_time, the counter would be set to zero on next successful login.

4、pam_faillock does not unlock account
pam_faillock (PAM Module) reads configuration file /etc/security/faillock.conf. However, faillock command does not read the config file. Therefore, the option must be manually set as command line parameter.
解决方法：
If dir option is used in pam_faillock, supply the faillock directory as command line option:

Raw
faillock --dir /var/log/faillock --user bob
faillock --dir /var/log/faillock --user bob --reset

5 SSHD configuration adjustment
If pam_faillock.so is not working as expected, the following changes may have to be made to SSHD’s configuration:

Raw

vi /etc/ssh/sshd_config

**ChallengeResponseAuthentication yes
Then restart the sshd service in order for these configuration changes to take effect:

Raw

systemctl restart sshd