How do I disable the wrong password delay for login attempts?

General system Newbie
1

I tried following some advice online to disable it by messing with stuff in /etc/pam.d/ but it didn’t seem to work, maybe due to configuration differences between then and now (probably some systemd shit i’m guessing)

How do I actually do it?

To clarify, if i wasn’t clear, if you use sudo and type a wrong password you have to wait a few seconds to try again, I want to not wait at all, or at least wait only a matter of milliseconds.

Note: This was how I did it How do I disable the wrong password delay for login attempts? - #9 by rabcor

2

You can change the delay in the pam configuration for it.

3

I somewhat warn against it. If you’re fumble fingers, and you’re more likely to trigger lockouts with a reduced delay.
Something to think about.

4

Other option is to disable the delay by adding “nodelay” to the faillock configuration or just comment out the lines with faillock.

5

Of course you could just set a blank password, but is that wise?

6

That’s not really a comparison with disabling faillock. You could still install your system with full disk encryption so that you have to enter a passphrase before your system boots and then disable login with password. I didn’t come here to argue about security practices, but to get OP’s questions answered.

1 Like
7

image
image1162×147 10.2 KB

That was what I had already tried actually, it doesn’t seem to work.

8

:backhand_index_pointing_up:

9

That works yes but do i want to do that? I’m not sure what faillock does isn’t it just locking password attempts after too many failed ones?

Anyhow, I figured out if I added nodelay to all the faillock lines it worked.

Specifically these 3 lines

auth       required                    pam_faillock.so      preauth nodelay
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok nodelay
auth       [default=die]               pam_faillock.so      authfail nodelay
10

It locks your account after too many failed attempts. I was getting confused of what you actually wanted, that’s why the answer of commenting out the faillock lines wouldn’t have helped since you just wanted to disable the delay and not disable the lockout.

11

The lockout is a fine feature i’ve rarely run into issues with it and it’s easy to unlock it too when it’s acting up

12

I’ve had myself locked out before when I’ve typed my password too many times in a day or when I had a really long day. :rofl:

13

I only had it happen because of some sudo bug two or three times like a year or 2 ago. it was something easily replicable too but i forgot the details.

I have a bash alias to fix it from back then.

alias fixsudo='faillock --user $USER --reset'

14

That doesn’t work when you still have to login, but useful if you are logged in.

15

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.