3

I would like to know if there are any common techniques of powering your computer off after a number of failed login attempts from the machine locally (from the terminal login, or from lightdm for example).

For SSH or any remote login, I would just use fail2ban. I'm asking this for the purposes of a personal computer, like desktop or laptop which is more likely to be stolen.

The reason I want the machine to power off during local brute force attempts is to force the thief out of the encrypted disk which had been unlocked during this bootup.

0

3 Answers 3

2
+50

Related to PAM, You would want to research how to implement pam_exec.so to run a script to power off the machine for failed login attempts during authentication.

There's a good resource here where someone implemented the same type of setup where he kept track of login counts to determine when the shutdown script should be called.

Source: https://cowboyprogrammer.org/2016/09/reboot_machine_on_wrong_password/

Hope this helps.

0

You could go with logwatcher or swatch and shutdown after X failed login attempts. Local bruteforce? -- You mean somebody has a FPGA physically attached to your server attempting brute force?

0

*First, to be safe, open another tty (Alt+Ctrl+F3) and login, so if you mess with your system you can revert your changes. (If you don't do that, you can still recover your system by: 1. At boot, edit grub boot line (press e) and add init=/bin/sh to the line starting by "linux", and when you reach the console: 2. mount -o remount,rw /

Create your script
sudo vi /opt/loginfail

With a content like this:

#!/bin/dash

workdir="/home/USER/Downloads/failedlogin.d/"
failfile="$workdir/failfile"

[ ! -d "$workdir" ] && mkdir "$workdir"
[ ! -f "$failfile" ] && echo "0" > "$failfile"

trial="$(cat "$failfile")"
trials="$((trial + 1))"
echo "$trials" > "$failfile"

if [ "$trials" -gt "2" ]; then
echo "0" > "$failfile"
sudo /sbin/poweroff --no-wall --poweroff
fi

Make it executable
sudo chmod +x /opt/loginfail

Edit /etc/pam.d/common-auth and change the line

auth [success=1 default=ignore] pam_unix.so nullok_secure

to

auth [success=2 default=ignore] pam_unix.so nullok_secure

and add the line:

auth [default=ignore] pam_exec.so seteuid /opt/loginfail

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .