I am trying to use pam_tally2 in /etc/pam.d galaxy

I change sshd to the following content

auth     required       pam_securetty.so
auth     required       pam_tally2.so deny=3 unlock_time=600
auth     required       pam_env.so
auth     required       pam_unix.so
auth     required       pam_nologin.so
account  required       pam_unix.so
password required       pam_unix.so
session  required       pam_limits.so
session  required       pam_unix.so
session  required       pam_lastlog.so nowtmp
session  optional       pam_mail.so standard

I created a test account; before login, I tested the failed login count:

pam_tally2 -u tst3402

now I log in using the correct password (this is done by an expect script, password is like aaa12BBB, )

spawn ssh -l tst3402
No mail.
Last login: Tue Mar 20 14:25:17 2018 from

status OK


  • status OK is sent by expect

I recheck the failure count

pam_tally2 -u tst3402
Login           Failures Latest failure     From
tst3402             1    03/20/18 14:25:17

This implies that after 3 sucessful logins, the account is locked.


why after a succesful login does pam_tally2 see 1 failures ?

usual suspect:

  • I know I can use ssh keys, but I am under ISAE3420's curse

  • using ssh -vvv -l ... I see two exchange .. I should see 2 failures ?

    debug3: send packet: type 50
    debug3: receive packet: type 51
  • there is no SELinux

  • I didn't find any pam_tally2 question in security.SE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.