Locking Accounts with pam_tally2 and pam_faillock

In this lesson, you will learn how to defend your Linux systems against automated brute-force attacks by implementing dynamic account lockout policies using PAM.

The Problem: Brute-Force Vulnerability

By default, standard Linux authentication allows an unlimited number of failed login attempts. An attacker could run a script to guess thousands of passwords per minute against your system. To prevent this, we utilize PAM modules that track failed attempts and automatically lock the user account once a specific threshold is reached.

Modernizing with pam_faillock

While pam_tally2 was historically used for this purpose, it is deprecated in modern distributions in favor of pam_faillock. Both operate on the same principle: keeping a counter of failed attempts and denying access when the limit is breached.

To configure pam_faillock, you modify the /etc/pam.d/common-auth or /etc/pam.d/system-auth files. You must place the module entries correctly to ensure they execute during the authentication stack:

# Add this to the auth stack (before pam_unix.so)
auth required pam_faillock.so preauth silent audit deny=3 unlock_time=600

# Add this to the auth stack (after pam_unix.so)
auth [default=die] pam_faillock.so authfail audit deny=3 unlock_time=600

How it Works

1. preauth: This phase tracks failed attempts before the password is even checked. If the user is already locked out, the system denies access immediately, saving resources.
2. authfail: This phase tracks failures that occur during the actual password verification process.
3. deny=3: This sets the threshold. After 3 failed attempts, the account is locked.
4. unlock_time=600: This defines the duration (in seconds) the account remains locked. After 10 minutes, the account automatically unlocks.

Managing Locks Manually If an authorized user gets locked out by accident, you do not need to wait for the timer to expire. You can manually reset the failure counter using the faillock utility:

sudo faillock --user <username> --reset

By integrating these modules, you move from an open-ended authentication process to a hardened, self-defending system that treats repeated failures as a security incident.

Key Takeaway: Automated lockout policies mitigate brute-force risks by tracking failed authentication attempts at the PAM layer and enforcing temporary access restrictions based on predefined failure thresholds.