Bug ID 440895: The BIG-IP system may intermittently fail to authenticate users with valid credentials

Last Modified: Mar 21, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP AFM, APM, ASM, AVR, CGN, EM, GTM, Install/Upgrade, Link Controller, LTM, PEM, PSM, SWG, vCMP, WAM, WOM(all modules)

Known Affected Versions:
10.2.4, 11.0.0, 11.1.0, 11.2.0, 11.2.1, 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4, 12.0.0

Fixed In:
12.1.0, 12.0.0 HF1

Opened: Dec 16, 2013
Severity: 3-Major
Related AskF5 Article:
K15285

Symptoms

On rare occasions, the BIG-IP system may intermittently fail to authenticate users with valid credentials. As a result of this issue, you may encounter one or more of the following symptoms: -- In the /var/log/secure log file, you notice an error message similar to the following example: PAM Couldn't lock /var/log/pam/tallylog : Resource temporarily unavailable -- Users with valid login credentials experience authentication failure. -- Automated connection requests, with authentication (such as iControl), to the affected BIG-IP system, may experience intermittent connection failures.

Impact

Users with valid credentials experience intermittent authentication failures.

Conditions

This issue occurs when the following condition is met: The BIG-IP system processes a high volume of invalid credential authentication requests. When local authentication with a login failure limit is set, high concurrent authentication attempts may trigger this issue. Simultaneous attempts to login via ssh, with the GUI, or other methods can cause a timing issue which might corrupt the /var/log/pam/tallylog file.

Workaround

Remove the tallylog file or reset all users via the GUI to have the system re-write the file.

Fix Information

None

Behavior Change