Of course, just after I sent this I saw a note from BartW about the pam_tally2 module, which does the same thing as pam_faillock. I did a local test enabling pam_faillock and it worked as expected. Seems the issue might be in pam_tally2 This may also be a duplicate of [0] which was seen before the sysadmin change. Sau! [0] https://bugs.launchpad.net/starlingx/+bug/1814345 On 7/2/19 1:45 PM, Saul Wold wrote:

Folks,

I am looking into this launchpad [0], this appears to be related to pam_faillock module which would be included in the /etc/pam.d/ configuration files.

When I search through the StarlingX repos, including of course the stx-integ/config-files/pam-config configuration, I could not find any mention of the faillock module before or after the sysadmin change. I am not exactly sure how the sysadmin change would affect pam configuration.

I found the new StarlingX test that are under review current has mention of pam faillock (as I mention in the lauchpad), it's a manual setup, not something that is defaulted in the current code.

Peng Peng mentions that faillock works with an older image (from May) that I don't have access to, if there is a copy of the ISO I can look at, I can validate the pam setup actuall includes the faillock module and to understand what's setting it and why the sysroot change would break it.

Is there a different subsystem that I am not aware that is checking for Authentication failures and lockouts?

[0] https://bugs.launchpad.net/bugs/1834116

Additional thoughts, pointers to code I am missing?

Thanks   Sau!

-------- Forwarded Message -------- Subject: [Bug 1834116] [NEW] sysadmin user not locked out after 5 wrong password attempts Date: Fri, 28 Jun 2019 19:26:40 -0000 From: Launchpad Bug Tracker <1834116@bugs.launchpad.net> Reply-To: Bug 1834116 <1834116@bugs.launchpad.net> To: sgw@linux.intel.com

Ghada Khalil (gkhalil) has assigned this bug to you for StarlingX:

Brief Description ----------------- login as: sysadmin, after 5 wrong password attempt, system does not logout and still could login by correct password

Severity -------- Major

Steps to Reproduce ------------------ 1. 5 wrong password attempt 2. login by correct password

TC-name: test_linux_user_lockout

Expected Behavior ------------------ system lockout and can not login

Actual Behavior ---------------- login success

Reproducibility --------------- Reproducible

System Configuration -------------------- Multi-node system

Lab-name: wcp_63-66

Branch/Pull Time/Commit ----------------------- stx master as of 20190622T013000Z

Last Pass --------- 20190503T013000Z

Timestamp/Logs -------------- 2019-06-23 04:07:57,399] 792  INFO  MainThread test_linux_user_password_aging.test_linux_user_lockout:: 1: Expecting to fail to login with invalid password, host:128.224.151.85, user:sysadmin, password:123

[2019-06-23 04:07:57,400] 710  INFO  MainThread test_linux_user_password_aging.log_in_raw:: logging onto host:128.224.151.85 as user:sysadmin with password:123

After 5 times attempt

[2019-06-23 04:08:12,134] 747  INFO  MainThread test_linux_user_password_aging.log_in_raw:: Error, expecting to fail but actually logged in,  host:128.224.151.85 as user:sysadmin with password:Li69nux*

output before:, after: Last failed login: Sun Jun 23 04:08:11 UTC 2019 from 128.224.150.21 on ssh:notty There were 10 failed login attempts since the last successful login. Last login: Sun Jun 23 04:07:57 2019 from 128.224.150.21

/etc/motd.d/00-header:

 WARNING: Unauthorized access to this system is forbidden and will be prosecuted by law. By accessing this system, you agree that your actions may be monitored if unauthorized usage is suspected.

[?1034hcontroller-1:~$

Test Activity ------------- Regression Testing

** Affects: starlingx      Importance: Medium      Assignee: Saul Wold (sgw-starlingx)          Status: Triaged

** Tags: stx.2.0 stx.regression stx.retestneeded stx.security