[ansible-project] Re: Sudo auth fails in the middle of playbook
The explanation seems to be that pam_tally2 records a failed login when login command is started, even before a password is entered. Normally, the failed logins counter is reset when the user enters the correct password. For login this works correctly when the following line is added in pam config (common-auth): auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root unlock_time=1200 serialize However, when using sudo, the counter only gets reset when the following line is added to pam configuration (common-account): accountrequiredpam_tally2.so So, the workaround is to add the above line in pam config. -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscr...@googlegroups.com. To post to this group, send email to ansible-project@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/ebd73833-aa88-41ab-93aa-530957a9c85a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[ansible-project] Re: Sudo auth fails in the middle of playbook
On Friday, November 25, 2016 at 11:24:28 AM UTC+2, Paul Tötterman wrote: > > Do you have more that one auth backend in PAM? like pam_unix + pam_ldap? >> Do those have different passwords? A fail in one doesn't necessarily mean >> that login fails. >> > I'm only using the pam_unix authentication method. Apart from pam_tally2 my pam config is just the default Ubuntu 16.04 config. thanks, marko -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscr...@googlegroups.com. To post to this group, send email to ansible-project@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/e5104718-ec58-422e-ab07-e6ab88173316%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[ansible-project] Re: Sudo auth fails in the middle of playbook
> > After running the playbook tally2 counts 14 failed logins for my account, > though the sudo password should've > been correctly entered (since some files do get created as root). > Do you have more that one auth backend in PAM? like pam_unix + pam_ldap? Do those have different passwords? A fail in one doesn't necessarily mean that login fails. Cheers, Paul -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscr...@googlegroups.com. To post to this group, send email to ansible-project@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/58d2ee9b-4c55-498c-8a95-45c9c7699aec%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[ansible-project] Re: Sudo auth fails in the middle of playbook
This seems to be related with our use of the pam_tally2 module. I've the fillowing configuration: auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root unlock_time=1200 When I disable this the playbook gets executed without errors. After running the playbook tally2 counts 14 failed logins for my account, though the sudo password should've been correctly entered (since some files do get created as root). -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscr...@googlegroups.com. To post to this group, send email to ansible-project@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/4307bc72-d19f-40df-9724-ab1f6cc2ea2b%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
