1

I've seen this question on AskUbuntu about monitoring lockscreen. However, imagine having an encrypted drive + home partition. Both are mounted and available while you are logged in.

The thing is, afaik, the number of attempts is not limited. How can I listen to unsuccessful attempts and after N tries just shut down the machine so I can prevent any further action that might target my storage via naive dictionary attack (e.g. friend/visit/...) on the lock screen?

Is there also any way for listening to unsuccessful attempts via tty? For example if someone tries to log in via tty1 twice and tty2 once (i.e. sum of all attempts 3), shutdown the machine too?

Improve this question

1 Answer 1

Reset to default
2

There are several PAM modules which can limit the number of attempts over time, e.g. pam_tally2 is available on most Linux distributions.

You can also create custom PAM modules, either in C or by using pam_exec to run custom shellscripts. For example, if the PAM stack looks like this:

(...)
auth [success=1 new_authtok_reqd=ok default=bad] pam_unix.so
auth optional pam_exec.so /usr/local/bin/count-or-shutdown.sh
(...)

then every successful password entry will skip over the pam_exec line, but every failed login will execute it.

Improve this answer
3
  • Does it apply to GUI too?
    – KeyWeeUsr
    Nov 18, 2019 at 12:59
  • 1
    As long as your GUI lockscreen actually uses PAM, yes. (If you're using a custom lockscreen like 'slock' which skips PAM and tries to do the absolute minimum amount of work, then all bets are off – if it doesn't call PAM, then it isn't going to send any other failure signal either.)
    – u1686_grawity
    Nov 18, 2019 at 13:03
  • I'll poke around to find whether my lockscreen uses PAM, but otherwise it's great!
    – KeyWeeUsr
    Nov 18, 2019 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .