Man page lists /etc/telnetrc and .telnetrc, neither of which is present on my machine, so I've nowhere to start.

I've also tried sudo faillog -u $USER -m 3 , but that didn't produce desired result for telnet.

System: Ubuntu 14.04 LTS


tl;dr: man pam_faillock or man pam_tally

Login authentication uses the Pluggable Authentication Mechanism. This has a configuration file per login service located in /etc/pam.d/. These configuration files refer to "PAM modules" which implement aspects of authenticaton and authorisation. Take a moment to see a concrete example by looking at /etc/pam.d/login, which is the authentication mechanism for the "login" command.

The module "pam_faillock" allows the counting and testing of the number of login attempts. Optionally, locked accounts can be automatically unlocked after some interval.

The manual page for pam_faillock has example /etc/pam.d configurations.

Most Linux distributions have each service refer to a single all-services authentication configuration (/etc/pam.d/password-auth in Red Hat land, /etc/pam.d/common-password in Debian-land). So use the example in the man page to inform your changes to those common files. To ease testing you may prefer to get the configuration right for just one service -- allowing you to login through other services to fix any errors -- before attempting to modify the all-services configuration.

Slightly older Linux distributions provide a similar facility using pam_tally.

  • pam settings dont seem to be working for a strange reason. Only /etc/login.defs. I've changed the default 5 login attemnts to 3 and it works with giving incorrect password on telnet localhost. Is that how it should work or is it some anomaly? – Sergiy Kolodyazhnyy Feb 9 '15 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.