In this article, we will learn how to lock user login after failed login attempts in Red Hat and CentOS. It is a security practice, which is important to implement in critical servers.

Earlier in RedHat based distro we used to setup pam_tally.so for locking the user login after some failed login attempts. Now in Red Hat 6.x and CentOS 6.x we will use pam_tally2.so .

Steps to lock user login after failed login attempts

In this section, we will follow the given below steps to configure lock user login post failed login attempts.

Edit PAM file

First take the backup of the given below file.

# cd /etc/pam.d
# cp -p password-auth-ac password-auth-ac.bak
# vi system-auth

Note: password-auth is softlink of original file password-auth-ac . ls -la password-auth

Now add these two lines in password-auth-ac or password-auth . Once you save the file, the setup is ready and now it will start taking action on failed login attempts.

auth required pam_tally2.so deny=3 unlock_time=36000 audit
account required pam_tally2.so

Below is the sample of my system’s password-auth file.

[root@localhost ~]# cat /etc/pam.d/password-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth required pam_tally2.so deny=3 unlock_time=36000 audit
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_localuser.so
account required pam_tally2.so
account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so [root@localhost ~]#

Find failed login attempts in log

By default the failed logs are saved in /var/log/tallylog .

To see user’s no. of failed attempts by PAM, use this command.

pam_tally2 -u username

Reset failed login attempts for user

To reset failed login log(like faillog -u username -r), use below command

pam_tally2 -u username --reset

To know what are the options you can use with pam_tally2.so .Read the file from below given path.

cat /usr/share/doc/pam-1.1.1/txts/README.pam_tally2