To block a user after a preset number of failed login attempts, one would use a module like pam_tally2 or pam_faillock.

What is the difference between these two? Which one should I use when?

  • Based on both modules manpage (pam_faillock and pam_tally2), it looks like pam_tally2 is a bit more evolved than pam_faillock, and comes with a userland program, pam_tally2, which allow you to manipulate counters (and so, speed up, or cancel a lock).
    – binarym
    Dec 18, 2019 at 16:30

2 Answers 2


Since Linux-PAM 1.4.0 (8th June, 2020) pam_tally and pam_tally2 were deprecated and pam_faillock was introduced, version 1.5.0 (10th November, 2020) removed pam_tally and pam_tally2

If your distro provides pam_faillock use that one, if not use pam_tally2

Source: https://github.com/linux-pam/linux-pam/tags


It appears that pam_faillock is the more evolved version, at least this was the case in 2016, when the author stated:

Comment (by tmraz):

I already submitted pam_faillock a few years ago. I agree with you that it should be included into Linux PAM and I really prefer not merging the code with pam_tally[2] as the internal design is quite different. I'd prefer to obsolete pam_tally and pam_tally2 altogether as their design is flawed.

Source: https://lists.fedorahosted.org/archives/list/[email protected]/thread/QIYGRKVWDHZUBQHOXZT67YJMCOEBDMHK/

Among the differences is that pam_faillock has improved handling of screensaver.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .