* src/login.c: Fix the count of failures before login exits in

	case of PAM enabled configurations.

diff --git a/ChangeLog b/ChangeLog
index ddc9ec0925787a73a6d454efaf6d75e7735e44ef..8fb472182a8de84341d3b21b4010a28a5afcdf7c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2009-04-12  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * src/login.c: Fix the count of failures before login exits in
+       case of PAM enabled configurations.
+
 2009-04-12  Nicolas François  <nicolas.francois@centraliens.net>
 
        * man/passwd.1.xml: Document that passwd uses PAM to authenticate

diff --git a/src/login.c b/src/login.c
index 3edc5610c8853b5dffca3e580823f4fef160d69e..a77ca756cf0c6434d7e4294aaf57e3721604cdfd 100644 (file)
--- a/src/login.c
+++ b/src/login.c
@@ -726,7 +726,7 @@ int main (int argc, char **argv)
                                failent_user = "UNKNOWN";
                        }
 
-                       if (retcode == PAM_MAXTRIES || failcount >= retries) {
+                       if (retcode == PAM_MAXTRIES) {
                                SYSLOG ((LOG_NOTICE,
                                         "TOO MANY LOGIN TRIES (%d)%s FOR '%s'",
                                         failcount, fromhost, failent_user));
@@ -769,6 +769,17 @@ int main (int argc, char **argv)
 
                        fprintf (stderr, "\nLogin incorrect\n");
 
+                       if (failcount >= retries) {
+                               SYSLOG ((LOG_NOTICE,
+                                        "TOO MANY LOGIN TRIES (%d)%s FOR '%s'",
+                                        failcount, fromhost, failent_user));
+                               fprintf(stderr,
+                                       _("Maximum number of tries exceeded (%d)\n"),
+                                       failcount);
+                               PAM_END;
+                               exit(0);
+                       }
+
                        /*
                         * Let's give it another go around.
                         * Even if a username was given on the command