I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local.
I need to lock users out after N failed password logins.
The examples in
man pam_tally2 and
pam_faillock do not lock a user using ssh out. The
pam_tally2 example can lock a telnet (I enabled to test) login & subsequently will lock an ssh user out. ssh cannot trigger it.
PasswordAuthentication yes # setting to no doesn't allow login with a password! UsePAM yes UseLogin no # setting to yes doesn't allow putty logins
Man page examples should work on an unaltered system.