I want to monitor a SuSE server by SCOM. The server has a SCOM user and SCOM server knows the username and password.
But the SCOM tries to login with that user and Failures count on pam_tally2 always increases. and if I try ssh with this user (scomuser) Failures count increases again. Success doesn't matter.
So, our deny count has been set 5 by the file /etc/pam.d/common-auth. If I remove this deny parameter scom can access to server but we don't remove this parameter because of hardening.
How can I stop the increasement of failures count or how can the scom server allways access to server by another way?
auth required pam_env.so auth optional pam_gnome_keyring.so auth required pam_unix.so try_first_pass account required pam_unix.so try_first_pass auth required pam_tally2.so deny=5 unlock_time=1200
account required pam_unix2.so use_first_pass