Account lockout does not function after multiple failed login attempts in Usage Meter 9.0 and 9.1

Products

VMware Usage Meter

Issue/Introduction

In Usage Meter 9.0 and Usage Meter 9.1 (upgraded from 9.0), user accounts (usagemeter or root) are not locked even after exceeding the threshold for consecutive failed login attempts via SSH, VAMI, or Web UI.

In /var/log/messages or support bundle logs (such as cap-appliance-management.service-000.log), authentication failures are logged, but the expected lockout message ("Consecutive login failures for user <username> account temporarily locked") is missing.

Environment

VCF Usage Meter 9.0
VCF Usage Meter 9.1

Cause

This issue occurs due to missing pam_faillock.so module configurations in the OS Pluggable Authentication Modules (PAM) files.

In Usage Meter 9.0, PAM configuration files (/etc/pam.d/system-auth and /etc/pam.d/system-account) do not include the pam_faillock calls by default. When upgrading from Usage Meter 9.0 to 9.1, these configuration files are preserved in their legacy state, causing the lockout mechanism to remain inactive for SSH and VAMI authentication.

In addition, failed login attempts on the standard Usage Meter Web UI (port 443) do not trigger an account lockout. This is a known issue in Usage Meter 9.0 and 9.1.

Resolution

SSH and VAMI (Port 5480): Can be resolved by applying the manual PAM configuration workaround described below.
Usage Meter Web UI (Port 443): Currently no workaround exists. This issue will be fixed in a future release.

Workaround (For SSH and VAMI Lockout)

Follow the steps below to enable account lockout for SSH and VAMI logins:

Log in to the Usage Meter appliance via SSH as the usagemeter user and switch to root.

Create backup copies of the PAM configuration files:

cp -a /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
cp -a /etc/pam.d/system-account /etc/pam.d/system-account.bak

Open /etc/pam.d/system-auth using a text editor (e.g., vi) and update the content as follows:

# Begin /etc/pam.d/system-auth

auth       required    pam_faillock.so preauth
auth       required    pam_unix.so
auth       required    pam_faillock.so authfail
auth       optional    pam_faildelay.so delay=4000000

# End /etc/pam.d/system-auth

Open /etc/pam.d/system-account and update the content as follows:

# Begin /etc/pam.d/system-account

account    required    pam_faillock.so
account    required    pam_unix.so

# End /etc/pam.d/system-account

Verify the configuration by intentionally entering an incorrect password via SSH or VAMI, then check the failure tally:
```
faillock
```
Expected Output:
```
Login           Failures    Latest failure         From
root                0
usagemeter          1
```

Additional Information

You may notice differences in /etc/security/faillock.conf between an upgraded instance and a clean installation of Usage Meter 9.1 (such as dir = /run/faillock vs dir = /var/log/faillock). Modifying /etc/security/faillock.conf is not required, as the primary cause of the lockout failure is the missing module declaration in the PAM configuration files.