I am having trouble with a configuration line in common-account-pc and common-auth-pc that denies also root access:

account  required  pam_tally2.so  deny=10 onerr=fail unlock_time=600 even_deny_root root_unlock_time=5 file=/home/log/faillog

It seems that this line causes some problem when trying to access multiple times the SUT and i assume that it things that it is an attack via ssh. But it is actually a test tool that tries to send several times commands via ssh root@ to the SUT ( from server (

Apr 25 05:51:56 SUT sshd[31570]: pam_tally2(sshd:auth): user root (0) tally 83, deny 10
Apr 25 05:52:16 SUT sshd[31598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=  user=root
Apr 25 05:52:21 SUT sshd[31568]: error: PAM: Authentication failure for root from
Apr 25 05:52:21 SUT sshd[31568]: Connection closed by [preauth]

Since the password is always correct, but still after some time it starts to through exception (pexpect) Account locked.

version: 2.3 ($Revision: 399 $)
command: /usr/bin/ssh
args: ['/usr/bin/ssh', 'root@']
searcher: searcher_re:
    0: re.compile(".*:~ #")
buffer (last 100 chars): :
Account locked due to 757 failed logins

before (last 100 chars): :
Account locked due to 757 failed logins

after: <class 'pexpect.TIMEOUT'>

But according to passwd root is not LK labeled:

SUT:~ # passwd -S root
root P 04/24/2017 -1 -1 -1 -1

Manually it is always possible to access the SUT via ssh root@!!!

So, for the moment the only that can cause this is the pam configuration. But how do i restart or activate the changes?

Does someone else have any other idea?

Thanks in adv.

2 Answers 2


There is no PAM daemon. You do not need to reload anything for the changes to take effect.

  • 5
    I dont think this is correct. Some changes in /etc/pam.d/sshd do not get reflected when restarting sshd service and only take effect after rebooting the machine.
    – Basil A
    Apr 26, 2020 at 13:48
  • Hi Basil, whic ones specifically? Jul 17 at 18:35

Maybe there are better/shorter approaches but I did a reload of my PAM auth configuration changes by running:

sudo /usr/sbin/pam-auth-update

Do not change anything in the window which'll popup and just press "Ok".

  • 1
    Have you an automatic way for unattented purpose ? I don't understand your -1
    – Et7f3XIV
    Jul 4 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.