Home / ubuntu / Questions / 678331
In Process
Ravan
Asked: 2015-09-26 06:08:05 +0800 CST

How to lock Ubuntu login screen after a certain number of unsuccessful attempts?

  • 772

I would like to know if it is possible to lock the login screen after a certain number of unsuccessful attempts.

  1. How can I unlock the login screen after a certain (predefined) amount of time?

  2. How can I unlock it with fixed commands from tty immediately without any effect from 1.?

Note: I am using Ubuntu 14.04 and referred here but unfortunately had no success.

edit :

(gedit:5558): Gtk-WARNING **: Calling Inhibit failed: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.SessionManager was not provided by any .service files

(gedit:5558): Gtk-WARNING **: Calling Inhibit failed: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.SessionManager was not provided by any .service files

** (gedit:5558): WARNING **: Set document metadata failed: Setting attribute metadata::gedit-spell-language not supported

** (gedit:5558): WARNING **: Set document metadata failed: Setting attribute metadata::gedit-spell-language not supported

** (gedit:5558): WARNING **: Set document metadata failed: Setting attribute metadata::gedit-position not supported

(gedit:5558): Gtk-WARNING **: Calling Inhibit failed: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.SessionManager was not provided by any .service files

(gedit:5558): Gtk-WARNING **: Calling Inhibit failed: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.SessionManager was not provided by any .service files

** (gedit:5558): WARNING **: Set document metadata failed: Setting attribute metadata::gedit-spell-language not supported

** (gedit:5558): WARNING **: Set document metadata failed: Setting attribute metadata::gedit-spell-language not supported
login

1 Answers

  1. See the command pam_tally2 From the link:

    EXAMPLES

   Add the following line to /etc/pam.d/login to lock the account after 4
   failed logins. Root account will be locked as well. The accounts will
   be automatically unlocked after 20 minutes. The module does not have to
   be called in the account phase because the login calls pam_setcred(3)
   correctly.

       auth     required       pam_securetty.so
       auth     required       pam_tally2.so deny=4 even_deny_root unlock_time=1200
       auth     required       pam_env.so
       auth     required       pam_unix.so
       auth     required       pam_nologin.so
       account  required       pam_unix.so
       password required       pam_unix.so
       session  required       pam_limits.so
       session  required       pam_unix.so
       session  required       pam_lastlog.so nowtmp
       session  optional       pam_mail.so standard

    The command 

    pam_tally2 --user {user}

    where {user} is a user will show how many failures have been logged.

    The command

    pam_tally2 --user {user} --reset

    will reset the tally for {user}.

    Alternative would be fail2ban but that needs installing. It is in USC so sudo apt-get install fail2ban will install it.

    • 2