Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I need to lock the users that are trying to log in via SSHD after 5 unsuccessful login tries. I already googled for it, but I just can see it working:

root@server:~# faillog -u testuser
Login       Failures Maximum Latest                   On
testuser        0        0   

The Maximum faillog is always 0 for a reason...

QUESTION: What packages do I need to have installed? What settings do I have to make? I know that I must have "UsePAM yes" in the sshd_config, that's OK. Does it counts that where am I putting the PAM lines in ex.: system-auth?

share|improve this question

marked as duplicate by slm, Anthon, jasonwryan, rahmu, manatwork Jun 15 '13 at 11:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted
  • Use the pam_tally2 module of pam(already built-in on pam package)
  • Add the following line on the /etc/pam.d/system-auth file

     auth required pam_tally.so onerr=fail deny=5 unlock_time=21600


  • deny=5: Number of tries
  • onerr=fail: Default behavior if something weird happens to pam
  • unlock_time: Number of seconds to unlock again the account.

Now, is just use pam(UsePam=yes) on sshd.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.