Pam tally
lastmod 2020-11-18created 2020-11-187 edits
Setting the account lockout threshold
RedHat family
Add the following to the /etc/pam.d/system-auth file.
-
auth required /lib/security/pam_tally.so deny=5 unlock_time=120 no_magic_root -
account required /lib/security/pam_tally.so no_magic_root reset
| Option | Description |
| no_magic_root | Do not apply the password lock setting to root |
| | Lock the password after 5 failed attempts | |
| unlock_time | After an account is locked, it is automatically unlocked once the set time has passed since the last failed attempt (unit: seconds) |
| reset | Reset the failure count on a successful login attempt |
Ubuntu family
Add the following to the /etc/pam.d/common-auth file.
-
auth required pam_tally2.so onerr=fail even_deny_root deny=5 unlock_time=600
| Option | Description |
| | Lock the password after 5 failed attempts | |
| | After an account is locked, it is automatically unlocked once the set time has passed since the last failed attempt (unit: seconds) |
The /etc/pam.d/common-account file can also be edited.
See also
- Linux PAM
- InformationSecurity:CheckList:Unix - security checklist for Unix-like systems.