pam_faillock.so配置信息不生效

### 问题描述
+ 内核版本:5.10.134-16.2.an8.x86_64
+ OS 版本:Anolis OS release 8.9
+ 平台架构:x86_64
+ 相关日志:
安全加固要求实现本地登录时允许5次密码尝试，5次失败后锁定当前账号10分钟，SSH远程登录也是同样的要求；我按照相关文档，分别修改了`/etc/pam.d/passsword-auth`和/etc/pam.d/system-auth
修改后的内容如下：

`/etc/pam.d/passsword-auth`
```
[root@localhost ~]# cat /etc/pam.d/password-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authselect is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so try_first_pass nullok
auth        required      pam_deny.so
auth        required      pam_faillock.so preauth audit deny=5 even_deny_root unlock_time=120
auth        [default=die] pam_faillock.so authfail audit deny=5 even_deny_root unlock_time=120
account     required      pam_unix.so no_pass_expiry
account     required      pam_faillock.so
password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
```

`/etc/pam.d/system-auth`
```bash
[root@localhost ~]# cat /etc/pam.d/system-auth 
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authselect is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so try_first_pass nullok
auth        required      pam_deny.so
auth        required      pam_faillock.so preauth silent audit deny=5 even_deny_root unlock_time=120
auth        [default=die] pam_faillock.so authfail audit deny=5 even_deny_root unlock_time=120

account     required      pam_unix.so no_pass_expiry
account     required      pam_faillock.so
password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
```

配置完成后我反复重启sshd服务后尝试远程登录，但是远程登录一直都只允许尝试3次密码登录
开始我以为是`password    requisite     pam_pwquality.so` 那一行的retry=3有冲突，把这个值改成了retry=5 还是只能输入3次密码

`ssh远程登录测试结果如下：`
```bash
[demo@laptop ~]$ ssh anuser@192.168.124.5
anuser@192.168.124.5's password: 
Permission denied, please try again.
anuser@192.168.124.5's password: 
Permission denied, please try again.
anuser@192.168.124.5's password: 
anuser@192.168.124.5: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
```

请问是我还有什么地方没有修改到才导致出现ssh远程登录 deny 值不生效？

### 复现

anolis/community

Content Risk Flag

Comments (2)

anolis/community .gitee-modal { width: 500px !important; }

Content Risk Flag