Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to implement account lockout in ubuntu using pam_tally. I have tried adding the follwing lines in /etc/pam.d/common-auth

auth required deny=3
account     required

The failures are getting logged but account is not getting locked even on reaching max failures. I am trying this by directly loggging in (GNOME login screen).

Any advices? Do I need to add in pam.d/gdm or login file also?

share|improve this question
Hello, this question has no information and activity for a very long time. I am voting to close it for now. If by any reason you think this question is still viable or useful in anyways or that there is still a good chance it will be answered please flag it to a moderator or add a comment with the reasons why you want it open. Regards. – Nitin Venkatesh Feb 28 '12 at 5:58

It has been a while since I looked at this, but

I think you need to edit /etc/pam.d/common-auth

Add this at the top of the file (order of rules matters).

auth required per_user magic_root onerr=fail

You then set the number of allowed attempts

sudo faillog -m 3

To unlock an account

faillog -u login_name -r

for additional details see

My blog

or man pam_tally

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.