pam_faillock: Lock User Accounts After Failed Logins on RHEL

pam_faillock counts consecutive failed authentication attempts and can temporarily lock a local account after a threshold. On RHEL, Rocky Linux, AlmaLinux, CentOS Stream, and Oracle Linux, you enable it through authselect and tune policy in /etc/security/faillock.conf — not by hand-editing /etc/pam.d/system-auth.

This guide is RHEL-family specific. Debian and Ubuntu also ship pam_faillock.so, but they stack PAM through common-auth and common-account without authselect. Mixing both layouts in one procedure confuses stack order, so keep Debian/Ubuntu lockout separate from this walkthrough.

What pam_faillock does on RHEL

pam_faillock replaces the older pam_tally2 module on current RHEL-family releases. Two pieces work together:

• pam_faillock.so — PAM module hooks in system-auth and password-auth
• faillock — command to inspect or reset failure records

Typical auth-stack placement:

• preauth — checks whether the user is already locked before password verification
• authfail — records a failure when authentication did not succeed
• account — prevents login when the account has reached the failure limit

Failure records live under /var/run/faillock/ by default. SSH logins include password-auth, so lockout applies to remote password authentication when that stack carries pam_faillock.

Quick reference

Confirm pam_faillock is installed

The pam package on RHEL-family systems ships the module, config file, and admin command. List those paths before you change authentication:

rpm -ql pam | grep faillock

Sample output:

/etc/security/faillock.conf
/usr/lib64/security/pam_faillock.so
/usr/sbin/faillock
/usr/share/man/man5/faillock.conf.5.gz
/usr/share/man/man8/faillock.8.gz
/usr/share/man/man8/pam_faillock.8.gz
/var/run/faillock

If pam_faillock.so is missing, install or update the pam package for your release before continuing.

Enable pam_faillock with authselect

On RHEL 8 and later, authselect owns system-auth and password-auth. Enable the built-in faillock feature instead of inserting lines by hand:

authselect enable-feature with-faillock

Confirm the profile lists with-faillock:

authselect current

Sample output:

Profile ID: local
Enabled features:
- with-faillock

When with-faillock appears under enabled features, authselect has wired pam_faillock into the managed stacks.

Set lockout policy in faillock.conf

Global limits belong in /etc/security/faillock.conf. Uncommented lines override compiled defaults. By default, pam_faillock allows three failed authentication attempts before denying further access for 600 seconds. Those defaults are:

deny = 3
fail_interval = 900
unlock_time = 600

You can make these values explicit in /etc/security/faillock.conf if you want them visible in the file rather than relying on compiled defaults.

To confirm active settings after you edit the file:

grep -vE '^(#|$)' /etc/security/faillock.conf

Sample output:

deny = 3
fail_interval = 900
unlock_time = 600

Common options in that file:

• deny — consecutive failures before lockout (default 3)
• fail_interval — seconds in which failures must occur (default 900)
• unlock_time — seconds until automatic unlock (0 means until manual reset)
• even_deny_root — apply lockout to root (use with care)
• local_users_only — track only users in /etc/passwd

Do not lock yourself out while testing over SSH. Use a disposable local user and keep a root session open.

Verify the PAM stack

SSH and many services include password-auth. Console login paths often pull in system-auth. Both stacks should reference pam_faillock:

grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth

Sample output:

/etc/pam.d/system-auth:auth        required                                     pam_faillock.so preauth silent
/etc/pam.d/system-auth:auth        required                                     pam_faillock.so authfail
/etc/pam.d/system-auth:account     required                                     pam_faillock.so
/etc/pam.d/password-auth:auth        required                                     pam_faillock.so preauth silent
/etc/pam.d/password-auth:auth        required                                     pam_faillock.so authfail
/etc/pam.d/password-auth:account     required                                     pam_faillock.so

Three lines per file — preauth, authfail, and account — mean SSH password logins can accumulate failures and enforce lockout.

Test account lockout over SSH

Use a test account so you do not risk locking your normal login:

useradd -m lockdemo

Set a known password on RHEL-family hosts with passwd --stdin:

echo 'LockDemoPass1!' | passwd --stdin lockdemo

Use a password you can deliberately type wrong during the SSH test — not your production credential.

Clear any old tally for that user before you start counting failures:

faillock --user lockdemo --reset

faillock --reset exits silently when no records exist — that is normal.

Attempt SSH with the wrong password three times from another session (replace the password placeholder with any incorrect value):

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no lockdemo@127.0.0.1

After three failed tries, list the failure records:

faillock --user lockdemo

Sample output:

lockdemo:
When                Type  Source                                           Valid
2026-08-21 09:46:36 RHOST 127.0.0.1                                            V
2026-08-21 09:46:42 RHOST 127.0.0.1                                            V
2026-08-21 09:46:51 RHOST 127.0.0.1                                            V

Each RHOST row is one failed authentication. After three recorded failures, the account is locked. Further authentication attempts are denied until unlock_time expires or you reset the tally.

Check the system journal for the lockout message:

journalctl --since '10 min ago' --no-pager | grep pam_faillock | tail -3

Sample output:

Aug 21 09:46:51 server.example.com sshd-session[318969]: pam_faillock(sshd:auth): Consecutive login failures for user lockdemo account temporarily locked

That line confirms pam_faillock blocked further attempts for lockdemo, not merely a wrong password on the last try.

Reset faillock and unlock the user

To let the user try again before unlock_time expires, reset the tally as root:

faillock --user lockdemo --reset

Verify that the failure tally is clear:

faillock --user lockdemo

Sample output:

lockdemo:
When                Type  Source                                           Valid

An empty table means no active failures. The user still needs the correct password — reset clears lockout state, not credentials.

When you finish testing, remove the test account:

userdel -r lockdemo

pam_faillock vs pam_tally2

RHEL 7 used the older authconfig workflow; this guide targets authselect-based RHEL 8 and later.

For legacy tally2 setup and root lockout edge cases, see pam_tally2 account lockout. To skip lockout for named service accounts while keeping faillock for everyone else, see exclude users from pam_faillock lockout.

Troubleshooting

References

• pam_faillock(8)
• faillock.conf(5)
• faillock(8)
• authselect(8)
• Red Hat — Account lockout with pam_faillock

Summary

On RHEL-family Linux, account lockout after repeated bad passwords belongs to pam_faillock managed through authselect. Enable with-faillock, set deny and unlock_time in /etc/security/faillock.conf, and confirm preauth, authfail, and account lines appear in both system-auth and password-auth before you test over SSH.

faillock.conf controls when accounts are locked and automatically unlocked. The faillock command shows or clears the failed-login records for individual users. A reset clears the failed-login count; it does not change the user's password.