To block a user after a preset number of failed login attempts, one would use a module like pam_tally2 or pam_faillock.

What is the difference between these two? Which one should I use when?

  • Based on both modules manpage (pam_faillock and pam_tally2), it looks like pam_tally2 is a bit more evolved than pam_faillock, and comes with a userland program, pam_tally2, which allow you to manipulate counters (and so, speed up, or cancel a lock). – binarym Dec 18 '19 at 16:30

It appears that pam_faillock is the more evolved version, at least this was the case in 2016, when the author stated:

Comment (by tmraz):

I already submitted pam_faillock a few years ago. I agree with you that it should be included into Linux PAM and I really prefer not merging the code with pam_tally[2] as the internal design is quite different. I'd prefer to obsolete pam_tally and pam_tally2 altogether as their design is flawed.

Source: https://lists.fedorahosted.org/archives/list/pam-developers@lists.fedorahosted.org/thread/QIYGRKVWDHZUBQHOXZT67YJMCOEBDMHK/

Among the differences is that pam_faillock has improved handling of screensaver.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.