Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I heard Centos can block user based on failed logins.

The post says by default it checks for /var/log/faillog how do I change this to another log file to keep trace of failed logins. I have a Plesk-managed server. I have to check /var/log/secure and /usr/local/psa/var/log/maillog. Can any one advise.

share|improve this question
up vote 0 down vote accepted

the faillog that page is referring to is a special file used by pma_tally. It doesnt scan logs looking for login failures.

Basically whenever you have a failed login, pam_tally records the entry in the faillog. Then whenever you go to log in, it looks in the faillog to see if you've exceeded the threshold. Once you have it starts refusing logins.

If you want to deny remote ssh logins based on log parsing you want either fail2ban or denyhosts. Both read logs to track login failures and add iptables or tcpwrapper deny rules to block access from the source IP (not based on user).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.