问题描述:
使用expect用户跳转时,关键代码:
spawn su - qrytest -c "sh ~/amenity/thread_ten.sh"
结果显示:
Password:
Last login: Fri Dec 24 14:16:15 CST 2021 from 55.11.28.23 on pts/11
Password:
Last login: Fri Dec 24 14:16:15 CST 2021 from 55.11.28.23 on pts/11
Password:
Last login: Fri Dec 24 14:16:15 CST 2021 from 55.11.28.23 on pts/11
Password:
Last login: Fri Dec 24 14:16:15 CST 2021 from 55.11.28.23 on pts/11
Password:
Last login: Fri Dec 24 14:16:15 CST 2021 from 55.11.28.23 on pts/11
Password:
Last login: Fri Dec 24 14:16:15 CST 2021 from 55.11.28.23 on pts/11
spawn su - test_arsj -c sh /test/script/test_arsj_evl_hit_s.sh 2021-12-21 TEST_MAG EVL
Account locked due to 7 failed logins
Password:
su: Authentication failure
spawn su - qrytest -c sh /test/script/test_arsj_evl_hit_s.sh 2021-12-21 TEST_MAG EVL
Account locked due to 8 failed logins
Password:
su: Authentication failure
spawn su - qrytest -c sh /test/script/test_arsj_evl_hit_s.sh 2021-12-21 TEST_MAG EVL
Account locked due to 9 failed logins
Password:
su: Authentication failure
spawn su - qrytest -c sh /test/script/test_arsj_evl_hit_s.sh 2021-12-21 TEST_MAG EVL
Account locked due to 10 failed logins
Password:
su: Authentication failure
分析情况:
1.并发一共有10个,密码使用是同一个,前6个正常,第7-10个登录认证失败
首先分析是有错误密码尝试,导致用户被锁,查看用户状态是属于正常的状态
# passwd -S qrytest
qrytest PS 2019-12-10 1 -1 7 -1 (Password set, SHA512 crypt.)
发现用户并未锁定,锁定状态为:
qrytest LK 2019-12-10 1 -1 7 -1 (Password locked.)
2.继续排查,获取登录失败的问题,使用命令行
lastb -a |more
发现被锁定的时候,用户登录显示ip为0.0.0.0,猜测应该是本地用户登录影响
扫描了下所有登录失败的特点,发现同时登录同一个用户过多时,会出现这个问题
因此,回归用户登录限制问题
处理方式:
查看用户限制问题
vim /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_tally2.so onerr=fail deny=6 unlock_time=300 even_deny_root root_unlock_time=300
auth required pam_faildelay.so delay=2000000
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
account required pam_tally2.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=6 minlen=8 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 enforce_for_root authtok_type=
password required pam_pwhistory.so use_authtok remember=10 enforce_for_root
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
发现限制用户连续错误登录被锁的deny=6次,符合该现象
auth required pam_tally2.so onerr=fail deny=6 unlock_time=300 even_deny_root root_unlock_time=300
因此尝试修改该参数为
auth required pam_tally2.so onerr=fail deny=12 unlock_time=300 even_deny_root root_unlock_time=300
任务执行成功,并发认证12个以内没有问题
报错解决!
疑问:
1.system-auth 中auth required参数为开启 onerr=fail ,即连续报错6次才会出现锁定问题,但是本次问题是同时发送6个以上的问题,用户也未被锁定,只是多余的登录无法成功认证,可能之间有联系。
2.尝试在并发中,错开发送,即发送5个以后sleep 1 秒后,认证也能正常成功,不知具体缘由。
问题已经解决,查看了一部分资料,依旧未能解决疑惑,如有大神能解答下,可以留言,谢谢!