Skip to content

Commit 1cd7c8b

Browse files
denisonbarbosadenisonbarbosa
committed
Return PAM_MAXTRIES on too many auth failures
We used to return PAM_AUTH_ERR, but this created problems in some adapters, since they would keep retriggering the authentication requests even after MAX_TRIES was reached. Returning PAM_MAXTRIES should stop the requests from coming.
1 parent 70591f9 commit 1cd7c8b

11 files changed

Lines changed: 23 additions & 19 deletions

File tree

‎examplebroker/broker.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -655,6 +655,7 @@ func (b *Broker) IsAuthenticated(ctx context.Context, sessionID, authenticationD
655655
sessionInfo.attemptsPerMode[sessionInfo.currentAuthMode]++
656656
if sessionInfo.attemptsPerMode[sessionInfo.currentAuthMode] >= maxAttempts {
657657
access = auth.Denied
658+
data = `{"message": "Maximum number of authentication attempts reached"}`
658659
}
659660
}
660661

‎pam/integration-tests/gdm_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -875,13 +875,13 @@ func TestGdmModule(t *testing.T) {
875875
},
876876
{
877877
Access: auth.Denied,
878-
Msg: "invalid password 'really, it's not a goodpass!', should be 'goodpass'",
878+
Msg: "Maximum number of authentication attempts reached",
879879
},
880880
},
881881
wantPamErrorMessages: []string{
882-
"invalid password 'really, it's not a goodpass!', should be 'goodpass'",
882+
"Maximum number of authentication attempts reached",
883883
},
884-
wantError: pam.ErrAuth,
884+
wantError: pam.ErrMaxtries,
885885
wantAcctMgmtErr: pam_test.ErrIgnore,
886886
},
887887
"Error_on_authenticating_unknown_user": {

‎pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,11 @@ invalid password 'wrongpass', should be 'goodpass'
8181
Press escape key to go back to select the authentication method
8282
────────────────────────────────────────────────────────────────────────────────
8383
> ./pam_authd login socket=${AUTHD_TEST_TAPE_SOCKET}
84-
PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
84+
PAM Error Message: Maximum number of authentication attempts reached
8585
PAM Authenticate()
8686
User: "user-integration-max-attempts@example.com"
87-
Result: error: PAM exit code: 7
88-
Authentication failure
87+
Result: error: PAM exit code: 11
88+
Have exhausted maximum number of retries for service
8989
PAM Info Message: acct=incomplete
9090
PAM AcctMgmt()
9191
User: "user-integration-max-attempts@example.com"

‎pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,11 @@ invalid password 'wrongpass', should be 'goodpass'
8181
Press escape key to go back to select the authentication method
8282
────────────────────────────────────────────────────────────────────────────────
8383
> ./pam_authd passwd socket=${AUTHD_TEST_TAPE_SOCKET}
84-
PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
84+
PAM Error Message: Maximum number of authentication attempts reached
8585
PAM ChangeAuthTok()
8686
User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com"
87-
Result: error: PAM exit code: 7
88-
Authentication failure
87+
Result: error: PAM exit code: 11
88+
Have exhausted maximum number of retries for service
8989
PAM Info Message: acct=incomplete
9090
PAM AcctMgmt()
9191
User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com"

‎pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,11 +147,11 @@ PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
147147
Enter 'r' to cancel the request and go back to select the authentication method
148148
Gimme your password:
149149
>
150-
PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
150+
PAM Error Message: Maximum number of authentication attempts reached
151151
PAM Authenticate()
152152
User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com"
153-
Result: error: PAM exit code: 7
154-
Authentication failure
153+
Result: error: PAM exit code: 11
154+
Have exhausted maximum number of retries for service
155155
acct=incomplete
156156
PAM AcctMgmt()
157157
User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com"

‎pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -166,11 +166,11 @@ PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
166166
Enter 'r' to cancel the request and go back to select the authentication method
167167
Gimme your password:
168168
>
169-
PAM Error Message: invalid password 'wrongpass', should be 'goodpass'
169+
PAM Error Message: Maximum number of authentication attempts reached
170170
PAM ChangeAuthTok()
171171
User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com"
172-
Result: error: PAM exit code: 7
173-
Authentication failure
172+
Result: error: PAM exit code: 11
173+
Have exhausted maximum number of retries for service
174174
acct=incomplete
175175
PAM AcctMgmt()
176176
User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com"

‎pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ invalid password 'wrongpass', should be 'goodpass'
147147
Enter 'r' to cancel the request and go back to select the authentication method
148148
(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached@example.com@localhost) Gimme your password:
149149
>
150-
invalid password 'wrongpass', should be 'goodpass'
150+
Maximum number of authentication attempts reached
151151
Received disconnect from ${SSH_HOST} port ${SSH_PORT} Too many authentication failures
152152
Disconnected from ${SSH_HOST} port ${SSH_PORT}
153153
>

‎pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_max_attempts_reached_with_shared_sshd‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ invalid password 'wrongpass', should be 'goodpass'
147147
Enter 'r' to cancel the request and go back to select the authentication method
148148
(user-integration-pre-check-ssh-deny-authentication-if-max-attempts-reached-with-shared-sshd@example.com@localhost) Gimme your password:
149149
>
150-
invalid password 'wrongpass', should be 'goodpass'
150+
Maximum number of authentication attempts reached
151151
Received disconnect from ${SSH_HOST} port ${SSH_PORT} Too many authentication failures
152152
Disconnected from ${SSH_HOST} port ${SSH_PORT}
153153
>

‎pam/integration-tests/testdata/tapes/native/max_attempts.tape‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,6 @@ Show
4444
Hide
4545
Type "wrongpass"
4646
Enter
47-
Wait+Nth(5) /invalid password 'wrongpass', should be/
47+
Wait+Screen /Maximum number of authentication attempts reached/
4848
${AUTHD_TEST_TAPE_COMMAND_AUTH_FINAL_WAIT}
4949
Show

‎pam/integration-tests/testdata/tapes/native/passwd_auth_fail.tape‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,6 @@ Show
5050
Hide
5151
Type "wrongpass"
5252
Enter
53-
Wait+Nth(5) /invalid password 'wrongpass', should be/
53+
Wait+Screen /Maximum number of authentication attempts reached/
5454
${AUTHD_TEST_TAPE_COMMAND_PASSWD_FINAL_WAIT}
5555
Show

0 commit comments

Comments
 (0)