Symantec Privileged Access Management

  • Private Community

  • 1.  failed login count increase when change password from PAM for linux device.

    Broadcom Employee
    Posted Dec 18, 2017 02:26 AM

    Customer manage password from PAM(3.0.2) on linux device.  It is found that when change password from PAM, failed login count increase on OS side.

     

    Account details as follows.

     

    Failed count before change password:

    Dec 10 22:08:10 huaso01-I7575 unix_chkpwd[114098]: password check failed for user (root)
    Dec 11 01:33:50 huaso01-I7575 unix_chkpwd[124793]: password check failed for user (root)
    Dec 11 01:33:57 huaso01-I7575 unix_chkpwd[124794]: password check failed for user (root)
    Dec 12 20:38:55 huaso01-I7575 unix_chkpwd[116772]: password check failed for user (pimadmin)
    Dec 15 03:02:36 huaso01-I7575 unix_chkpwd[11894]: password check failed for user (pimadmin)
    Dec 15 03:04:51 huaso01-I7575 unix_chkpwd[12206]: password check failed for user (pimadmin)
    Dec 15 03:16:01 huaso01-I7575 unix_chkpwd[12630]: password check failed for user (pimadmin)
    Dec 15 03:22:44 huaso01-I7575 unix_chkpwd[12860]: password check failed for user (pimadmin)
    Dec 15 03:41:55 huaso01-I7575 unix_chkpwd[14259]: password check failed for user (pimadmin)
    Dec 17 19:39:59 huaso01-I7575 unix_chkpwd[63689]: password check failed for user (pimadmin)
    Dec 17 19:52:48 huaso01-I7575 unix_chkpwd[64130]: password check failed for user (pimadmin)
    Dec 17 20:20:22 huaso01-I7575 unix_chkpwd[65746]: password check failed for user (pimadmin)

     

    Change password by click generate credentials->OK. confirmed password changed.

     

    Failed login count increased by one:

     

    Dec 11 01:33:57 huaso01-I7575 unix_chkpwd[124794]: password check failed for user (root)
    Dec 12 20:38:55 huaso01-I7575 unix_chkpwd[116772]: password check failed for user (pimadmin)
    Dec 15 03:02:36 huaso01-I7575 unix_chkpwd[11894]: password check failed for user (pimadmin)
    Dec 15 03:04:51 huaso01-I7575 unix_chkpwd[12206]: password check failed for user (pimadmin)
    Dec 15 03:16:01 huaso01-I7575 unix_chkpwd[12630]: password check failed for user (pimadmin)
    Dec 15 03:22:44 huaso01-I7575 unix_chkpwd[12860]: password check failed for user (pimadmin)
    Dec 15 03:41:55 huaso01-I7575 unix_chkpwd[14259]: password check failed for user (pimadmin)
    Dec 17 19:39:59 huaso01-I7575 unix_chkpwd[63689]: password check failed for user (pimadmin)
    Dec 17 19:52:48 huaso01-I7575 unix_chkpwd[64130]: password check failed for user (pimadmin)
    Dec 17 20:20:22 huaso01-I7575 unix_chkpwd[65746]: password check failed for user (pimadmin)
    Dec 18 02:21:47 huaso01-I7575 unix_chkpwd[83421]: password check failed for user (pimadmin)
    [root@huaso01-I7575 ~]#

     

    No custom script used all use default script.

    I dont see this behavior in 2.8.4 version of PAM. It seems update password script changed in 3.0.2.

     

    Any thought?

     

     

    Best Regards

     

    Jerry



  • 2.  Re: failed login count increase when change password from PAM for linux device.

    Broadcom Employee
    Posted Dec 18, 2017 03:52 AM

    Hi Jerry

    Some more investigation is required on this matter. Can you please open a support case and attach the catalina log to it so that we can verify the behavior ?



  • 3.  Re: failed login count increase when change password from PAM for linux device.
    Best Answer

    Broadcom Employee
    Posted Dec 18, 2017 09:16 AM

    Hello, This is how PAM works at present. Any time a new password is set, PAM first tries to verify the new password, which implies making an attempt to logon using the new password. This makes sense when the password is entered manually on the PAM UI as there is a good chance that the PAM administrator entered the current password for a new or out-of-sync account. It isn't really right for password updates by scheduled jobs, because we know that the newly generated password cannot be the current one. PAM Engineering is aware of this and may change the functionality in future.



  • 4.  Re: failed login count increase when change password from PAM for linux device.

    Broadcom Employee
    Posted Dec 18, 2017 07:22 PM

    Hello Ralf,

     

    Thanks for the explanation, so only way to mitigate this problem is use custom script instead of default script or there is better way?

     

     

    Best Regards

     

    Jerry 



  • 5.  Re: failed login count increase when change password from PAM for linux device.

    Broadcom Employee
    Posted Dec 19, 2017 09:37 AM

    Hi Jerry, This logic is not controlled by the scripts. You can't do anything about this behavior at present. You know you can ignore these messages if they precede a password change.