sysadmin user not locked out after 5 wrong password attempts

[Peng Peng]

Brief Description
-----------------
login as: sysadmin, after 5 wrong password attempt, system does not logout and still could login by correct password

Severity
--------
Major

Steps to Reproduce
------------------
1. 5 wrong password attempt
2. login by correct password

TC-name: test_linux_user_lockout

Expected Behavior
------------------
system lockout and can not login

Actual Behavior
----------------
login success

Reproducibility
---------------
Reproducible

System Configuration
--------------------
Multi-node system

Lab-name: wcp_63-66

Branch/Pull Time/Commit
-----------------------
stx master as of 20190622T013000Z

Last Pass
---------
20190503T013000Z

Timestamp/Logs
--------------
2019-06-23 04:07:57,399] 792 INFO MainThread test_linux_user_password_aging.test_linux_user_lockout:: 1: Expecting to fail to login with invalid password, host:128.224.151.85, user:sysadmin, password:123

[2019-06-23 04:07:57,400] 710 INFO MainThread test_linux_user_password_aging.log_in_raw:: logging onto host:128.224.151.85 as user:sysadmin with password:123

After 5 times attempt

[2019-06-23 04:08:12,134] 747 INFO MainThread test_linux_user_password_aging.log_in_raw:: Error, expecting to fail but actually logged in, host:128.224.151.85 as user:sysadmin with password:Li69nux*

output before:, after:
Last failed login: Sun Jun 23 04:08:11 UTC 2019 from 128.224.150.21 on ssh:notty
There were 10 failed login attempts since the last successful login.
Last login: Sun Jun 23 04:07:57 2019 from 128.224.150.21

/etc/motd.d/00-header:


WARNING: Unauthorized access to this system is forbidden and will be
prosecuted by law. By accessing this system, you agree that your
actions may be monitored if unauthorized usage is suspected.

[?1034hcontroller-1:~$

Test Activity
-------------
Regression Testing

[Ghada Khalil (gkhalil)]

Marking as stx.2.0 gating; was working until recently, so perhaps something was missed in the transition from wrsroot to sysadmin.

Assigning to Saul to review or re-assign to someone in his team

[Saul Wold (sgw-starlingx)]

Interesting, this is not code that I have changed. This would normally be handled by PAM and I reviewed the changes to the pam configuration can not find that the faillock (which is the module) that would do the locking has never been referenced.

I found references to faillock in the new test repo's tests here [1]

:Test ID: SECURITY_password_rule_setup_03
:Test Title: password rule locked out.
:Tags: psswd

It had a "Test Setup" section that required editing the pam.d files to enable the faillock module.

[1] doc/source/manual_tests/security/security_passw_rule_setup.rst

Is it possible the test listed in this bug report is run after the manual modifications for the password rule locked out test?

[Ghada Khalil (gkhalil)]

The fix was submitted for the duplicate bug:
https://review.opendev.org/669279

Merged on 2019-07-09

[Ghada Khalil (gkhalil)]

An additional fix was required for the duplicate bug:
https://review.opendev.org/670955

Merged on 2019-07-26