Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local.

I need to lock users out after N failed password logins.

The examples in man pam_tally2 and pam_faillock do not lock a user using ssh out. The pam_tally2 example can lock a telnet (I enabled to test) login & subsequently will lock an ssh user out. ssh cannot trigger it.

/etc/ssh/sshd_config has:

PasswordAuthentication yes # setting to no doesn't allow login with a password!
UsePAM yes
UseLogin no # setting to yes doesn't allow putty logins

Man page examples should work on an unaltered system.

share|improve this question
This doesn't answer your question directly, but, try fail2ban. (It's in EPEL.) – mattdm Feb 12 '13 at 1:19

If you enable PasswordAuthentication then the SSH daemon handles passwords itself and not using PAM. You actually want to disable this in order to force it to use PAM:

PasswordAuthentication no
UsePAM yes
ChallengeResponseAuthentication yes

That won't catch users using keys however (although personally I think that's fine). If you do you'll probably have to use something like fail2ban which looks for authentication failures in the logs and adds iptables rules to block future attempts.

share|improve this answer

I had to edit '/etc/pam.d/sshd '


Auth required Deny=5 Unlock_time=1200 Even_deny_root Root_unlock_time=10

and it works now.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.