so I am trying to accomplish something and I can't quite get it. I am trying to limit login attempts to 3 (via ssh, terminal or gui. After those 3 failed attempts, I want to lock the account for 1 hour.

I have two test accounts that were working normally before the changes: user1 is an ldap account and user2 is a local account with a set password

After making the changes on system-auth and password-auth suggested on the rhel site, I am unable to login at all. Luckily I did not modify the root account and I can still access the system, but I fail to udnerstand what went wrong.

Both files system-auth and password-auth are the same, this is the config I have:

auth        required      pam_env.so
auth        required      pam_faillock.so preauth silent deny=3 unlock_time=3600 fail_interval=900
auth        sufficient    pam_unix.so nullok try_first_pass
auth        [default=die] pam_faillock.so authfail deny=3 unlock_time=3600 fail_interval=900
auth        sufficient     pam_faillock.so authsucc audit deny=3
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_faillock.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so 
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

I checked passwd -S user1 and it doesn't seem to be locked out,and under the logs all I can see is Failed password for both accounts.

Can anyone guide me or point me to be able to accomplish what I want? I just want to enforce failed login attempts and the lockout timing.


First, pam_faillock does not lock the account as seen by passwd -S user. It would never work for LDAP accounts. To see accounts locked by this method, simply run faillock. Example:

[root@localhost ~]# faillock
When                Type  Source                                           
2013-03-05 11:44:14 TTY   pts/0                                                

To unlock a user's account, run:

faillock --user <username> --reset

Now, as to why this could be giving you problems. I am not so sure about that third faillock line in the auth section. In the example I have used to implement faillock, it is not present. Also, the audit command is missing from the first entry.

But, I can't imagine that is the reason for your trouble as explained by the man page.


     Will log the user name into the system log if the user is not found.

You mention that you used RHEL site to implement this. It may be helpful to see that URL and compare it to what I am looking at because they are slightly different.

See: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/security_guide/index#sect-Security_Guide-Workstation_Security-Account_Locking

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.