[Starlingx-discuss] Fwd: [Bug 1834116] [NEW] sysadmin user not locked out after 5 wrong password attempts

[Saul Wold]

Of course, just after I sent this I saw a note from BartW about the 
pam_tally2 module, which does the same thing as pam_faillock.  I did a 
local test enabling pam_faillock and it worked as expected.

Seems the issue might be in pam_tally2

This may also be a duplicate of [0] which was seen before the sysadmin 
change.

Sau!

[0] https://bugs.launchpad.net/starlingx/+bug/1814345

On 7/2/19 1:45 PM, Saul Wold wrote:
> 
> Folks,
> 
> I am looking into this launchpad [0], this appears to be related to 
> pam_faillock module which would be included in the /etc/pam.d/ 
> configuration files.
> 
> When I search through the StarlingX repos, including of course the 
> stx-integ/config-files/pam-config configuration, I could not find any 
> mention of the faillock module before or after the sysadmin change. I am 
> not exactly sure how the sysadmin change would affect pam configuration.
> 
> I found the new StarlingX test that are under review current has mention 
> of pam faillock (as I mention in the lauchpad), it's a manual setup, not 
> something that is defaulted in the current code.
> 
> Peng Peng mentions that faillock works with an older image (from May) 
> that I don't have access to, if there is a copy of the ISO I can look 
> at, I can validate the pam setup actuall includes the faillock module 
> and to understand what's setting it and why the sysroot change would 
> break it.
> 
> Is there a different subsystem that I am not aware that is checking for 
> Authentication failures and lockouts?
> 
> [0] https://bugs.launchpad.net/bugs/1834116
> 
> Additional thoughts, pointers to code I am missing?
> 
> Thanks
>    Sau!
> 
> 
> -------- Forwarded Message --------
> Subject: [Bug 1834116] [NEW] sysadmin user not locked out after 5 wrong 
> password attempts
> Date: Fri, 28 Jun 2019 19:26:40 -0000
> From: Launchpad Bug Tracker <1834116 at bugs.launchpad.net>
> Reply-To: Bug 1834116 <1834116 at bugs.launchpad.net>
> To: sgw at linux.intel.com
> 
> Ghada Khalil (gkhalil) has assigned this bug to you for StarlingX:
> 
> Brief Description
> -----------------
> login as: sysadmin, after 5 wrong password attempt, system does not 
> logout and still could login by correct password
> 
> Severity
> --------
> Major
> 
> 
> Steps to Reproduce
> ------------------
> 1. 5 wrong password attempt
> 2. login by correct password
> 
> TC-name: test_linux_user_lockout
> 
> Expected Behavior
> ------------------
> system lockout and can not login
> 
> 
> Actual Behavior
> ----------------
> login success
> 
> 
> Reproducibility
> ---------------
> Reproducible
> 
> 
> System Configuration
> --------------------
> Multi-node system
> 
> 
> Lab-name: wcp_63-66
> 
> 
> Branch/Pull Time/Commit
> -----------------------
> stx master as of 20190622T013000Z
> 
> 
> Last Pass
> ---------
> 20190503T013000Z
> 
> 
> Timestamp/Logs
> --------------
> 2019-06-23 04:07:57,399] 792  INFO  MainThread 
> test_linux_user_password_aging.test_linux_user_lockout:: 1: Expecting to 
> fail to login with invalid password, host:128.224.151.85, user:sysadmin, 
> password:123
> 
> [2019-06-23 04:07:57,400] 710  INFO  MainThread
> test_linux_user_password_aging.log_in_raw:: logging onto
> host:128.224.151.85 as user:sysadmin with password:123
> 
> After 5 times attempt
> 
> 
> [2019-06-23 04:08:12,134] 747  INFO  MainThread 
> test_linux_user_password_aging.log_in_raw:: Error, expecting to fail but 
> actually logged in,  host:128.224.151.85 as user:sysadmin with 
> password:Li69nux*
> 
> output before:, after: Last failed login: Sun Jun 23 04:08:11 UTC 2019 
> from 128.224.150.21 on ssh:notty
> There were 10 failed login attempts since the last successful login.
> Last login: Sun Jun 23 04:07:57 2019 from 128.224.150.21
> 
> /etc/motd.d/00-header:
> 
> 
> WARNING: Unauthorized access to this system is forbidden and will be
> prosecuted by law. By accessing this system, you agree that your
> actions may be monitored if unauthorized usage is suspected.
> 
> [?1034hcontroller-1:~$
> 
> 
> Test Activity
> -------------
> Regression Testing
> 
> ** Affects: starlingx
>       Importance: Medium
>       Assignee: Saul Wold (sgw-starlingx)
>           Status: Triaged
> 
> 
> ** Tags: stx.2.0 stx.regression stx.retestneeded stx.security