I want to monitor a SuSE server by SCOM. The server has a SCOM user and SCOM server knows the username and password.

But the SCOM tries to login with that user and Failures count on pam_tally2 always increases. and if I try ssh with this user (scomuser) Failures count increases again. Success doesn't matter.

So, our deny count has been set 5 by the file /etc/pam.d/common-auth. If I remove this deny parameter scom can access to server but we don't remove this parameter because of hardening.

How can I stop the increasement of failures count or how can the scom server allways access to server by another way?

common-auth file:

auth    required        pam_env.so
auth    optional        pam_gnome_keyring.so
auth    required        pam_unix.so     try_first_pass
account required        pam_unix.so     try_first_pass
auth    required        pam_tally2.so deny=5 unlock_time=1200

common-account file:

account required pam_unix2.so use_first_pass

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.