Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?

share|improve this question
I get the need for a delay from a security perspective, but the default delay is rather annoying – Mike Pennington Jun 16 '12 at 21:41
This has been interesting; maybe I'll write a module that allows N tries with no delay followed by any number of tries with a long delay. – Shawn J. Goff Jun 16 '12 at 23:27
Instead of a new module (suggested in my previous comment), I used pam_unix with the nodelay option and pam_tally2 with deny=5 unlock_time=15; this allows for 5 immediate retries, but denies access (even with a successful password) for 15 seconds. I still intend to try writing the described model, but now it's a back-burner project, because this would not be suitable if your primary access to the system is network-based since it makes a DOS attack trivial. – Shawn J. Goff Jun 20 '12 at 22:25
if you are concerned about a network DoS from timeouts, use fail2ban... in fact use it even if you think you're safe :-). i use two day ban times – Mike Pennington Jun 20 '12 at 23:18

2 Answers 2

up vote 14 down vote accepted

I assume you are using Linux and pam. The delay is probably caused by Check your pam configuration in /etc/pam.d using pam_faildelay, e.g:

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional  delay=3000000

To change the time adjust the delay parameter. If you want to get rid of the delay you can delete/comment the complete line.

Another source for the delay may be To disable the delay caused by add the nodelay parameter.

share|improve this answer
There is no mention of delay anywhere in /etc/pam.d/*. The closest thing I see is which allows locking after some number of attempts. But I do have n /etc/login.defs, which might be what I need. – Shawn J. Goff Jun 16 '12 at 16:53
@ShawnJ.Goff does not cause an delay as far as i know. Another source for the dealy may be - you can disable it with the nodelay option - see for more details – Ulrich Dangel Jun 16 '12 at 17:07
Adding the nodelay option to and adding a new entry with delay=$some_number lets me set whatever I want. Thanks! – Shawn J. Goff Jun 16 '12 at 22:13

You need to pass the nodelay parameter to the auth

Depending on how your'e authenticating, where you need to set the parameter varies. However most linux distrubtions have something like /etc/pam.d/system-auth which is included by all the different files.

So for example in /etc/pam.d/system-auth you might have a line that looks like this:

auth            sufficient try_first_pass nullok

This should be changed to:

auth            sufficient try_first_pass nullok nodelay

The module is what performs authentication against /etc/passwd and /etc/shadow. If youre using LDAP or some other password backend, you likely should still be setting nodelay on the as that is what controls the prompt (when fails to auth, it usually just passes the password it obtained to the next module).

You can read more about by doing man pam_unix

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.