Pam - locks out users

Latest response

Hello,

I followed the instructions of the RHEL7 security guide (chapter 4.1.2/Account Locking). Everything was working as expected (users were locked out as expected after 3 failed attempts), until i tried to rename the configuration files with the commands (as stated in the security guide):
~]# mv /etc/pam.d/system-auth /etc/pam.d/system-auth-ac
~]# mv /etc/pam.d/password-auth /etc/pam.d/password-auth-ac
So, almost imediatly sudo command was not working and because of the even_deny_root parameter, after the reboot the root account was also locked... (mounting the encrypted volume from a recovery linux dvd and edidting the modified pam files gave me full access again).

After this failed attempt i re-followed the steps of the security guide, but instead of the mv commands I used cp commands:
sudo cp /etc/pam.d/system-auth /etc/pam.d/system-auth-ac
sudo cp /etc/pam.d/password-auth /etc/pam.d/password-auth-ac
And hopefully this time everything was working as expected (even_deny_root parameter was not used as a full lock-out precaution).

In the next reboot I realized that the administrator-user account password was not accepted at the login prompt of the graphical interface, while i was able to log (as root or user) in in any of the ttys (Ctrl+Alt+F2...). Running the command: faillock --user myusername, there where no failed login attempts but only until a failed login in a tty has occured..

(I uploaded the config files and to be able to do so i renamed them to .txt)

I cannot find the root cause of the problem... Any ideas please?

Attachments

SK
Log in to join the conversation

Responses

p5 Newbie 17 points
18 August 2016 7:00 PM

According to the security guide, you need to make 'system-auth' and 'password-auth' a symbolic link to your custom file. By default, these should be symbolic links to 'system-auth-ac' and 'password-auth-ac'.

Try copying 'system-auth-ac' to 'system-auth-local', and make your adjustments to 'system-auth-local'. Then, change the symbolic link 'system-auth' to point to 'system-auth-local'. Do the same with the equivalent files for 'password-auth'.

Re-read section Keeping Custom Settings with authconfig in the security guide.

SK Community Member 20 points
19 August 2016 3:04 PM

First of all thanks for your responce! In every of my attempts after edidting the files: 'system-auth-local' and 'password-auth-local' (exactly the same as in the security guide) i did created the symbolic links as stated in the security guide with the commands:

sudo ln -sf /etc/pam.d/system-auth-local /etc/pam.d/system-auth

sudo ln -sf /etc/pam.d/password-auth-local /etc/pam.d/password-auth

Unfortunately, with no results and as stated above the second time i couldn't log in to the graphical interface (login in the ttys was successful).

So i haven't found the cause of the problem yet...

thomas.jones2@dodiis.mil's picture Guru 6435 points
19 August 2016 4:57 PM

Oof. No. Never rename those files. If you run authconfig, it should set up appropriate names and symlinks for you. That said, if you've already hand-edited those files, those changes could be lost - so, you might want to run authconfig first, THEN edit ...or see if authconfig's options allow you to set the desired config-items via the tool

p5 Newbie 17 points
19 August 2016 5:08 PM

It's hard to tell exactly what is going on. I'm fairly certain it appears that the OP is cutting and pasting steps directly from the Security Guide. Those steps actually include renaming system-auth to system-auth-ac (although it seems to me that system-auth is a link to system-auth-ac by default) and then creating a new symlink system-auth to system-auth-local.

There is certainly something not working correctly in the OP's PAM configuration. Things like sudo should reference system-auth, so I would not expect things to break if the steps in the Security Guide are being followed correctly.

SK Community Member 20 points
20 August 2016 2:55 PM

The bellow was tested in a "fresh" install. The files 'system-auth' and 'password-auth' BEFORE EDIT (or AFTER executing: sudo authconfig --updare) are indeed (as already mentioned) sysmbolic links to 'system-auth-ac' and 'password-auth-ac'.

sudo ls -la /etc/pam.d/{system-auth,password-auth}

lrwxrwxrwx. 1 root root 16 Aug 20 16:41 /etc/pam.d/password-auth -> password-auth-ac

lrwxrwxrwx. 1 root root 14 Aug 20 16:41 /etc/pam.d/system-auth -> system-auth-ac

So we do not rename them to 'password-auth-ac' and 'system-auth-ac' respectively. We create the files 'system-auth-local' and 'password-auth-local'. Then, we create the symbolic links:

sudo ln -sf /etc/pam.d/system-auth-local /etc/pam.d/system-auth

sudo ln -sf /etc/pam.d/password-auth-local /etc/pam.d/password-auth

sudo ls -la /etc/pam.d/{system-auth,password-auth} lrwxrwxrwx. 1 root root 30 Aug 20 16:59 /etc/pam.d/password-auth -> /etc/pam.d/password-auth-local lrwxrwxrwx. 1 root root 28 Aug 20 16:59 /etc/pam.d/system-auth -> /etc/pam.d/system-auth-local

As a FINAL step we edit the 'system-auth-ac' and 'password-auth-ac' files.

AND nothing...the problem remains! The graphical interface doesn't logs in the user.

SK Community Member 20 points
20 August 2016 2:58 PM

Restoring the default config files and trying again:

  1. Creating the 'system-auth-local' and 'password-auth-local' files according to the security guide.

  2. Creating the symbolic links:

    sudo ln -sf /etc/pam.d/system-auth-local /etc/pam.d/system-auth &&

    sudo ln -sf /etc/pam.d/password-auth-local /etc/pam.d/password-auth

  3. DO NOT modify the files 'system-auth-ac' and 'password-auth-ac' as stated in the security guide since not only its pointless (they are restored to their default values by sudo authconfig --update) but also i think this was causing the problem (a double definition of the added roules in the custom files and the system files, because of the include control flag).

Now when a user account is locked after three failed attempts his account is successfully locked and after:

faillock --user myusername --reset

the user can successfully log in the gui and the ttys.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.