Bug 56547 - replace pam_tally with pam_faillock
Summary: replace pam_tally with pam_faillock
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: PAM
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.1
Assignee: Julia Bremer
QA Contact: Florian Best
URL:
Keywords:
Depends on:
Blocks: 58496
  Show dependency treegraph
 
Reported: 2023-09-05 21:13 CEST by Florian Best
Modified: 2025-07-31 14:55 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Development Internal
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments
Make nss-pam-ldapd use LDAP_DN_FORMAT_LDAPV3 (1.04 KB, patch)
2023-09-07 09:10 CEST, Julia Bremer
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2023-09-05 21:13:55 CEST
pam_tally is deprecated and has been removed.
We have to replace it with pam_faillock.
Comment 2 Julia Bremer univentionstaff 2023-09-07 09:08:58 CEST
We replaced pam_tally with pam_faillock.
I also fixed an error in the script /usr/lib/univention-pam/lock-user.
It only disabled a user if its failed login attempts are bigger then the configured limit. But this is not the behavior of either pam_faillock nor pam_tally. A user is locked if it reaches the limit, not only if they surpass it. 


During the tests, we found that account pam_unix.so doesn't work with nss-pam-ldapd if a user contains umlauts, because the username gotten from LDAP was escaped and the following LDAP searches yielded no results. Therefore the pam module came to the conclusion that there was no user with that username. 
The patch is attached here.

ucs:
217e6c06a3 fixup! Issue #1741: Adjust configuration and tests to pam_faillock
ecabd50584 replace pam_tally with pam_faillock

ucs-patches:
3bcea28bb (HEAD -> main, origin/main, origin/HEAD) Issue #1741: Handle umlauts in nss-pam-ldapd
Comment 3 Julia Bremer univentionstaff 2023-09-07 09:10:21 CEST
Created attachment 11113 [details]
Make nss-pam-ldapd use LDAP_DN_FORMAT_LDAPV3
Comment 4 Florian Best univentionstaff 2023-09-20 14:44:41 CEST
Already required in UCS 5.1.
Comment 5 Florian Best univentionstaff 2023-10-17 15:40:16 CEST
OK: migration of pam_tally to pam_faillock
OK: adjusted behavior that disabling of user happens when reaching the limit
OK: users with umlauts, nslcd patch
OK: I send your patch to upstream with your name: https://github.com/arthurdejong/nss-pam-ldapd/pull/62/
OK: changelog entry
Comment 6 Florian Best univentionstaff 2024-03-08 10:55:09 CET
univention-pam (14.0.6)
6a9f2ec94246 | fix(pam): replace pam_tally with pam_faillock

univention-management-console (13.0.8)
6a9f2ec94246 | fix(pam): replace pam_tally with pam_faillock

univention-directory-manager-modules (16.0.6)
6a9f2ec94246 | fix(pam): replace pam_tally with pam_faillock

univention-base-files (10.0.4)
6a9f2ec94246 | fix(pam): replace pam_tally with pam_faillock

ucs-test (11.0.7)
6a9f2ec94246 | fix(pam): replace pam_tally with pam_faillock
Comment 7 Florian Best univentionstaff 2024-03-08 10:55:29 CET
The patch might not be accepted upstream: https://github.com/arthurdejong/nss-pam-ldapd/pull/62/