I would like to configure the no. of times user will be prompted for password(authentication attempts) for login, before dropping the session. Does PAM support this case, if so can you help me out with the configuration required for this ?


There is a login counter module for PAM called pam_tally which can be used maintain a count of attempted login attempts, and block further attempts if a certain number of login attempts fail.


On Debian you could add the following lines to /etc/pam.d/common-auth to give users three login attempts before the account is locked:

auth required pam_tally.so onerr=fail deny=3 no_magic_root

The no_magic_root prevents the root user from being locked out.

As peterph pointed out, the unlock_time option can be used to specify a number of seconds after which a locked-out account will automatically be unlocked. By setting this option to 1, i.e. locking the account for one second, the login attempt can be aborted after a specified number of tries, while still allowing the user to retry (almost) immediately.

Adding the following line to /etc/pam.d/common-account will reset the login count on a successful login:

account required pam_tally.so reset no_magic_root

On Fedora, both lines can be added to /etc/pam.d/system-auth.

Access to a locked-out user account can be restored with the accompanying pam_tally utility as follows:

$ pam_tally --user user --reset=0
| improve this answer | |
  • Hi Thomas, Thanks for your prompt response. I do not want to lock the user, he should be able to try logging in again. I would like to control the no. of authentication attempts before dropping the session. – Sravani Oct 7 '13 at 13:53
  • @Sravani that's exactly what pam_tally does. Just use unlock_time=1 - that will lock the account for one second. You may also try -1 (if I'm reading the code right, it should work). – peterph Oct 7 '13 at 14:45
  • Thanks Thomas for your advice. This should work for me but I already have another requirement to lock the user upon a configurable no. of attempts, for that purpose I'm using hte pam_tally2 config. Will it work if I have 2 lines with different deny=<value> parameter. – Sravani Oct 7 '13 at 15:46
  • @Sravani I'm assuming that will work as long as you use separate files to keep the login counts for each module invocation. pam_tally defaults to using /var/log/faillog, while pam_tally2 defaults to /var/log/tallylog. Both accept a file options which can be used to specify the tally file. – Thomas Nyman Oct 7 '13 at 17:21
  • I required account required pam_tally2.so in mine, rather than pam_tally.so. My end solution was to have both on the off chance it changes. – SEoF Feb 20 '18 at 10:07

If you're trying to control how many times someone will be prompted, rather than how many times they can fail to authenticate, you might have trouble managing this through PAM. For example, ssh has its own config for this:

         Specifies the number of password prompts before giving up.  The
         argument to this keyword must be an integer.  The default is 3.
| improve this answer | |
  • Hi Joshua, Thanks for your reply. I'm using SSH service by xinetd, I read somewhere that whichever(among SSH & PAM) is lesser is taken into effect. Do you know how to configure this in PAM ? – Sravani Oct 7 '13 at 15:31
  • I don't know how to configure this in PAM, and I also don't know if it's possible. In this case you're trying to define how many times an application will ask PAM, which is out of PAM's control. I feel like this is like trying to specify how many database queries an application will issue by setting a configuration parameter in the database; it's outside of the database's control. – Joshua Miller Oct 7 '13 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.