[Starlingx-discuss] Fwd: [Bug 1834116] [NEW] sysadmin user not locked out after 5 wrong password attempts

[Saul Wold]

Folks,

I am looking into this launchpad [0], this appears to be related to 
pam_faillock module which would be included in the /etc/pam.d/ 
configuration files.

When I search through the StarlingX repos, including of course the 
stx-integ/config-files/pam-config configuration, I could not find any 
mention of the faillock module before or after the sysadmin change. I am 
not exactly sure how the sysadmin change would affect pam configuration.

I found the new StarlingX test that are under review current has mention 
of pam faillock (as I mention in the lauchpad), it's a manual setup, not 
something that is defaulted in the current code.

Peng Peng mentions that faillock works with an older image (from May) 
that I don't have access to, if there is a copy of the ISO I can look 
at, I can validate the pam setup actuall includes the faillock module 
and to understand what's setting it and why the sysroot change would 
break it.

Is there a different subsystem that I am not aware that is checking for 
Authentication failures and lockouts?

[0] https://bugs.launchpad.net/bugs/1834116

Additional thoughts, pointers to code I am missing?

Thanks
   Sau!


-------- Forwarded Message --------
Subject: [Bug 1834116] [NEW] sysadmin user not locked out after 5 wrong 
password attempts
Date: Fri, 28 Jun 2019 19:26:40 -0000
From: Launchpad Bug Tracker <1834116 at bugs.launchpad.net>
Reply-To: Bug 1834116 <1834116 at bugs.launchpad.net>
To: sgw at linux.intel.com

Ghada Khalil (gkhalil) has assigned this bug to you for StarlingX:

Brief Description
-----------------
login as: sysadmin, after 5 wrong password attempt, system does not 
logout and still could login by correct password

Severity
--------
Major


Steps to Reproduce
------------------
1. 5 wrong password attempt
2. login by correct password

TC-name: test_linux_user_lockout

Expected Behavior
------------------
system lockout and can not login


Actual Behavior
----------------
login success


Reproducibility
---------------
Reproducible


System Configuration
--------------------
Multi-node system


Lab-name: wcp_63-66


Branch/Pull Time/Commit
-----------------------
stx master as of 20190622T013000Z


Last Pass
---------
20190503T013000Z


Timestamp/Logs
--------------
2019-06-23 04:07:57,399] 792  INFO  MainThread 
test_linux_user_password_aging.test_linux_user_lockout:: 1: Expecting to 
fail to login with invalid password, host:128.224.151.85, user:sysadmin, 
password:123

[2019-06-23 04:07:57,400] 710  INFO  MainThread
test_linux_user_password_aging.log_in_raw:: logging onto
host:128.224.151.85 as user:sysadmin with password:123

After 5 times attempt


[2019-06-23 04:08:12,134] 747  INFO  MainThread 
test_linux_user_password_aging.log_in_raw:: Error, expecting to fail but 
actually logged in,  host:128.224.151.85 as user:sysadmin with 
password:Li69nux*

output before:, after: Last failed login: Sun Jun 23 04:08:11 UTC 2019 
from 128.224.150.21 on ssh:notty
There were 10 failed login attempts since the last successful login.
Last login: Sun Jun 23 04:07:57 2019 from 128.224.150.21

/etc/motd.d/00-header:


WARNING: Unauthorized access to this system is forbidden and will be
prosecuted by law. By accessing this system, you agree that your
actions may be monitored if unauthorized usage is suspected.

[?1034hcontroller-1:~$


Test Activity
-------------
Regression Testing

** Affects: starlingx
      Importance: Medium
      Assignee: Saul Wold (sgw-starlingx)
          Status: Triaged


** Tags: stx.2.0 stx.regression stx.retestneeded stx.security
-- 
sysadmin user not locked out after 5 wrong password attempts
https://bugs.launchpad.net/bugs/1834116
You received this bug notification because you are a bug assignee.