[patch] respect faillock with kerberos

krb5.patch (text/plain), 918 bytes, created by Manuel Mommertz on 2020-11-02 10:05:39 UTC

--- templates/system-auth.tpl	2020-10-26 23:48:39.000000000 +0100
+++ templates/system-auth.tpl	2020-10-29 07:35:25.454465197 +0100
@@ -3,17 +3,18 @@
 auth		sufficient	pam_ssh.so
 {% endif %}
 
+auth		requisite	pam_faillock.so preauth
+
 {% if krb5 %}
-auth		[success=3 default=ignore]      pam_krb5.so {{ krb5_params }}
+auth		[success=2 default=ignore]      pam_krb5.so {{ krb5_params }}
 {% endif %}
 
-auth		requisite	pam_faillock.so preauth
 auth		[success=1 default=ignore]	pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
 auth		[default=die]	pam_faillock.so authfail
 auth		optional	pam_permit.so
 
 {% if krb5 %}
-account		[success=2 default=ignore]	pam_krb5.so {{ krb5_params }}
+account		[success=1 default=ignore]	pam_krb5.so {{ krb5_params }}
 {% endif %}
 account		required	pam_unix.so {{ debug|default('', true) }}
 account         required        pam_faillock.so