Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then).

Is it doable?

share|improve this question
up vote 2 down vote accepted

You can use the pam_succeed_if module in your stack to provide exceptions for some users. Check the pam_succeed_if(8) manpage for in-depth explanation of the syntax. An example would be:

auth [success=1 default=ignore] gid eq 2000
auth required          deny=5 onerr=fail unlock_time=1200

That means, if the pam_succeed_if test returns successfully, i.e., for all users in the group whose GID is 2000, skip the following test (pam_tally2); if the test returns failure, ignore it and continue.

Several pam_succeed_if tests can be stacked up for fine-grained control.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.