How to Lock Linux Accounts Using pam_tally2

Linux uses the pam_tally2 module within its Pluggable Authentication Modules (PAM) framework to protect systems against brute-force password attacks. This article explains how pam_tally2 operates, how to configure it to track failed authentication attempts and lock accounts automatically, and how administrators can inspect and unlock affected user accounts.

How pam_tally2 Works

The pam_tally2 module tracks user login attempts in a system tally database, typically located at /var/log/tallylog. Each time a login fails, the counter increments for that user. When the counter reaches a predefined limit, the module blocks subsequent authentication attempts until either an administrator clears the lock or a specified cooldown period expires. When authentication succeeds, the counter can be configured to automatically reset to zero.

Configuring pam_tally2

To enforce account locking, pam_tally2 must be integrated into the system's PAM configuration files, such as /etc/pam.d/system-auth and /etc/pam.d/password-auth on RHEL/CentOS systems, or /etc/pam.d/common-auth and /etc/pam.d/common-account on Debian/Ubuntu systems.

Configuration requires adding rules to both the auth and account PAM stacks.

1. Authentication Configuration

Add the module to the auth section:

auth required pam_tally2.so deny=5 unlock_time=900 onerr=fail audit

• deny=5: Locks the account after five consecutive failed attempts.
• unlock_time=900: Keeps the account locked for 900 seconds (15 minutes). After this period, the account automatically unlocks.
• onerr=fail: Denies access if an internal error occurs (such as an inaccessible tally file).
• audit: Logs the user's username to the system logs if the user does not exist.
• even_deny_root (optional): Enforces the lock policy on the root account as well.

2. Account Configuration

Add the module to the account section to verify account availability and reset counters upon successful login:

account required pam_tally2.so

Placing this entry in the account stage ensures that active locks are checked and enforced during login processing.

Managing Locked Accounts

Administrators can use the standalone command-line utility pam_tally2 to inspect and modify login counters.

Check Login Attempts

To view the current failed attempt count for a specific user:

pam_tally2 --user=username

To display failed attempts for all users on the system:

pam_tally2

Manually Unlock an Account

If a user requires access before the unlock_time expires, an administrator can manually reset the counter:

pam_tally2 --user=username --reset

This clears the failed login count in /var/log/tallylog and restores normal access immediately.