After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?

  • 1
    I get the need for a delay from a security perspective, but the default delay is rather annoying Jun 16, 2012 at 21:41
  • 3
    This has been interesting; maybe I'll write a module that allows N tries with no delay followed by any number of tries with a long delay. Jun 16, 2012 at 23:27
  • 1
    Instead of a new module (suggested in my previous comment), I used pam_unix with the nodelay option and pam_tally2 with deny=5 unlock_time=15; this allows for 5 immediate retries, but denies access (even with a successful password) for 15 seconds. I still intend to try writing the described model, but now it's a back-burner project, because this would not be suitable if your primary access to the system is network-based since it makes a DOS attack trivial. Jun 20, 2012 at 22:25
  • 1
    if you are concerned about a network DoS from timeouts, use fail2ban... in fact use it even if you think you're safe :-). i use two day ban times Jun 20, 2012 at 23:18

2 Answers 2


I assume you are using Linux and pam. The delay is probably caused by pam_faildelay.so. Check your pam configuration in /etc/pam.d using pam_faildelay, e.g:

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

To change the time adjust the delay parameter. If you want to get rid of the delay you can delete/comment the complete line.

Another source for the delay may be pam_unix.so. To disable the delay caused by pam_unix.so add the nodelay parameter, and optionally add a line calling pam_faildelay.so to add a (variable) delay instead, e.g.:

auth       optional   pam_faildelay.so  delay=100000
  • 3
    There is no mention of delay anywhere in /etc/pam.d/*. The closest thing I see is pam_tally.so which allows locking after some number of attempts. But I do have n /etc/login.defs, which might be what I need. Jun 16, 2012 at 16:53
  • @ShawnJ.Goff pam_tally.so does not cause an delay as far as i know. Another source for the dealy may be pam_unix.so - you can disable it with the nodelay option - see linux.die.net/man/8/pam_unix for more details Jun 16, 2012 at 17:07
  • 1
    Adding the nodelay option to pam_unix.so and adding a new entry with pam_faildelay.so delay=$some_number lets me set whatever I want. Thanks! Jun 16, 2012 at 22:13
  • 2
    Running fedora 23, I had to disable the pam_unix.so delay and start using the pam_faildelay.so one as @ShawnJ.Goff says. However, most pam.d configs have "This file is auto-generated. User changes will be destroyed the next time authconfig is run." So where can I permanently configure the delay?
    – jozxyqk
    Jan 29, 2016 at 7:34

You need to pass the nodelay parameter to the auth pam_unix.so.

Depending on how your'e authenticating, where you need to set the parameter varies. However most linux distrubtions have something like /etc/pam.d/system-auth which is included by all the different files.

So for example in /etc/pam.d/system-auth you might have a line that looks like this:

auth            sufficient      pam_unix.so try_first_pass nullok

This should be changed to:

auth            sufficient      pam_unix.so try_first_pass nullok nodelay

The pam_unix.so module is what performs authentication against /etc/passwd and /etc/shadow. If youre using LDAP or some other password backend, you likely should still be setting nodelay on the pam_unix.so as that is what controls the prompt (when pam_unix.so fails to auth, it usually just passes the password it obtained to the next module).

You can read more about pam_unix.so by doing man pam_unix

  • 1
    On my system system-auth did not exist; it was /etc/common-auth. Thanks!
    – Luc
    Jul 30, 2016 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.