Description Jan-Luca Kiok 2025-02-17 18:22:56 CET

## Context/description

With UCS: 5.2-0 errata26, when `auth/faillog` and `auth/faillog/lock_global` are enabled, this should lead to disabled user accounts when there are too many login attempts.

```
ucr set auth/faillog=yes
ucr set auth/faillog/lock_global=yes
```

This results in the file:

```pam
# Warning: This file is auto-generated and might be overwritten by
#          univention-config-registry.
#          Please edit the following file(s) instead:
# Warnung: Diese Datei wurde automatisch generiert und kann durch
#          univention-config-registry ueberschrieben werden.
#          Bitte bearbeiten Sie an Stelle dessen die folgende(n) Datei(en):
# 
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/00_header
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/30_tally
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/35_oidc
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/40_saml
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/50_base
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/59_auth_end
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/60_account
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/70_session
# 	/etc/univention/templates/files/etc/pam.d/univention-management-console.d/80_password
# 

auth     [success=1 user_unknown=1 \
         default=bad]      pam_faillock.so preauth
auth     [default=die]     pam_runasroot.so program=/usr/lib/univention-pam/lock-user


account  required              pam_faillock.so



auth     sufficient        pam_unix.so try_first_pass
auth     sufficient        pam_krb5.so use_first_pass defer_pwchange minimum_uid=1000
auth     sufficient        pam_sss.so use_first_pass

auth     required          pam_deny.so
account  sufficient        pam_unix.so
account  sufficient        pam_krb5.so force_pwchange minimum_uid=1000
account  required          pam_sss.so

session  required          pam_unix.so

password requisite         pam_pwquality.so
password sufficient        pam_unix.so obscure use_first_pass use_authtok
password required          pam_krb5.so use_first_pass use_authtok force_pwchange minimum_uid=1000
```

But users are not locked out, as authentication failures are **not** locked:

```bash
root@primary:~# python3 -c 'import pam; print([pam.authenticate("demo_admin", "univention", "univention-management-console") for _ in range(6)])'
[True, True, True, True, True, True]

# using the service `univention-management-console` repeatedly with a wrong password does not lead to disabling the account
root@primary:~# python3 -c 'import pam; print([pam.authenticate("demo_admin", "wrongpassword", "univention-management-console") for _ in range(6)])'
[False, False, False, False, False, False]
root@primary:~# udm users/user list --filter uid=demo_admin --properties disabled
uid=demo_admin
DN: uid=demo_admin,cn=lehrer,cn=users,ou=DEMOSCHOOL,dc=school,dc=test
  disabled: 0


# using a service like login will lead to a disabled account
root@primary:~# python3 -c 'import pam; print([pam.authenticate("demo_admin", "wrongpassword", "login") for _ in range(6)])'
[False, False, False, False, False, False]
root@primary:~# udm users/user list --filter uid=demo_admin --properties disabled
uid=demo_admin
DN: uid=demo_admin,cn=lehrer,cn=users,ou=DEMOSCHOOL,dc=school,dc=test
  disabled: 1
```

The `faillock` command does not show any tracked failed login attempts.
Looks like the line `auth required pam_faillock.so authfail` is missing?


In 5.0-9 it works:

```
root@primary:~# python3 -c 'import pam; print([pam.authenticate("demo_admin", "wrongpassword", "univention-management-console") for _ in range(6)])'
[False, False, False, False, False, False]
root@primary:~# udm users/user list --filter uid=demo_admin --properties disabled
uid=demo_admin
DN: uid=demo_admin,cn=lehrer,cn=users,ou=DEMOSCHOOL,dc=school,dc=test
  disabled: 1
```