Cannot Log In to ARTESCA CLI After Too Many Failed Login Attempts

Problem Description

You are unable to log in to the ARTESCA CLI after too many failed login attempts.

In the logs, you see the following error message:

[artesca-os@bootstrap ~]$

sudo journalctl -t login -t unix_chkpwd


Oct 31 10:42:47 artesca-node-1 unix_chkpwd[92326]: password check failed for user (artesca-os)
Oct 31 10:42:47 artesca-node-1 login[1608]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=ttyS0 ruser= rhost=  user=artesca-os
Oct 31 10:42:48 artesca-node-1 login[1608]: FAILED LOGIN 1 FROM ttyS0 FOR artesca-os, Authentication failure
Oct 31 10:42:56 artesca-node-1 unix_chkpwd[92660]: password check failed for user (artesca-os)
Oct 31 10:42:58 artesca-node-1 login[1608]: FAILED LOGIN 2 FROM ttyS0 FOR artesca-os, Authentication failure
Oct 31 10:43:04 artesca-node-1 unix_chkpwd[93114]: password check failed for user (artesca-os)
Oct 31 10:43:04 artesca-node-1 login[1608]: pam_faillock(login:auth): Consecutive login failures for user artesca-os account temporarily locked
Oct 31 10:43:06 artesca-node-1 login[1608]: FAILED LOGIN SESSION FROM ttyS0 FOR artesca-os, Authentication failure
Oct 31 10:43:06 artesca-node-1 login[1608]: PAM 2 more authentication failures; logname=LOGIN uid=0 euid=0 tty=ttyS0 ruser= rhost=  user=artesca-os
Oct 31 10:44:47 artesca-node-1 login[94001]: pam_unix(login:session): session opened for user artesca-os by LOGIN(uid=0)
Oct 31 10:44:47 artesca-node-1 login[94001]: DIALUP AT ttyS0 BY artesca-os
Oct 31 10:44:47 artesca-node-1 login[94001]: LOGIN ON ttyS0 BY artesca-os
Oct 31 10:51:29 artesca-node-1 login[110958]: FAILED LOGIN SESSION FROM pts/1 FOR (unknown), Conversation error

Root Cause

ARTESCA hardens the security of the system by locking the account after too many failed login attempts. This aims at preventing brute force attacks.

The following settings are used to lock the account after consecutive failed login attempts:

  • Failed attempts lockout is configured to 3.

  • Password unlock time is configured to 900 seconds.

  • Failed attempts lockout includes root account.

Investigation Step

You can view the failed logins for artesca-os user for example, with faillock:

[artesca-os@bootstrap ~]$

faillock --user artesca-os


artesca-os:
When                Type  Source                                           Valid
2024-10-31 10:42:47 TTY   ttyS0                                                V
2024-10-31 10:42:56 TTY   ttyS0                                                V
2024-10-31 10:43:04 TTY   ttyS0                                                V

Problem Resolution

  1. Open a console and connect to your server management tool (iDRAC, iLO, IMM, etc.). using the root user.

  2. Once connected to the server, unlock the account with the following command.

    [root@<NODE_NAME> ~]#

    faillock --user artesca-os --reset

  3. Log in to the ARTESCA CLI with the artesca-os user.