Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I set login throttling and lockout policies on a Linux (specifically Debian) system?

Things like, setting retry count, delays between login attempts, and idle session timeouts.

The box in question is a headless server, so SSH settings are acceptable. Thanks!

share|improve this question

On my DMZ box...

# cat /etc/debian_version 

I primarily use a combination of DenyHosts and SSHD configuration tweaks to accomplish those things, which are obviously heavily dependent on your particular goals. For security reasons, I'm not inclined to post my denyhosts.conf file - but the FAQ (linked herein) should hit on a few of your questions quickly.

share|improve this answer

Matt's recommendations are sensible - but you should also have a look at how pam is configured.

Note that this is not the way to prevent completely unauthorized system access - for that you need to have a look at the sshd config, firewall, fail2ban, and possibly 2-factor authentication.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.