Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to implement account lockout in ubuntu using pam_tally. I have tried adding the follwing lines in /etc/pam.d/common-auth

auth required deny=3
account     required

The failures are getting logged but account is not getting locked even on reaching max failures. I am trying this by directly loggging in (GNOME login screen).

Any advices? Do I need to add in pam.d/gdm or login file also?

share|improve this question
Hello, this question has no information and activity for a very long time. I am voting to close it for now. If by any reason you think this question is still viable or useful in anyways or that there is still a good chance it will be answered please flag it to a moderator or add a comment with the reasons why you want it open. Regards. – Nitin Venkatesh Feb 28 '12 at 5:58

It has been a while since I looked at this, but

I think you need to edit /etc/pam.d/common-auth

Add this at the top of the file (order of rules matters).

auth required per_user magic_root onerr=fail

You then set the number of allowed attempts

sudo faillog -m 3

To unlock an account

faillog -u login_name -r

for additional details see

My blog

or man pam_tally

share|improve this answer

Explanation Behind common-auth

If you're just looking for a quick fix, go below to How to Configure common-auth to Lock Out.

Hopefully this will help bring some sense into how /etc/pam.d/common-auth configures lockout.

If you take out all the comments in /etc/pam.d/common-auth, you are left with the following:

auth    [success=1 default=ignore] nullok_secure
auth    requisite             
auth    required              

Let's take a look at each line of this file and how it's used.

auth    [success=1 default=ignore] nullok_secure

Reads password input. If the password is correct, the next line of the file is skipped (the one with You can change how many lines are skipped by setting the value in success=1.

auth    requisite             

Immediately fail the login attempt. The word requisite here tells the authentication to quit immediately upon failure. The other lines use required instead, which waits until the end of the module to signal a failure.

auth    required              

Permits login attempt. This is done using

Once that is established, configuring the module to lock out the user can be better understood.

How to Configure common-auth to Lock Out

For Ubuntu:

Add the following line at the bottom:

auth    required    onerr=fail deny=3 unlock_time=1800

Change the line to the following:

auth    required              

The entire file would look like this:

auth    [success=1 default=ignore] nullok_secure
auth    required              
auth    required              
auth    required    onerr=fail deny=3 unlock_time=1800

You can configure the following options to suit your needs:

  • deny=3 - The number of attempts allowed before you are locked out.
  • unlock_time=1800 - The number of seconds before you are allowed to attempt to log in again. (Additional note: if the system unlocks after a series of failures, and you fail to authenticate again, you do not have 2 more tries to authenticate. The system makes you wait out the unlock-time again.)

Most resources recommend that this line be added at the top of the file, emphasizing the importance of order; however, on Ubuntu desktop systems, this configuration can lock you out of the GUI login screen.

Why does this happen? It seems that when you select a user on Ubuntu's login screen, the PAM module immediately begins, and it waits at the line (the password input line) before proceeding. If you place the line before this "stopping point", lockout immediately becomes active, and if you navigate away from the user by pressing the arrow keys, the module signals a failure to log in and pam_tally2 increments. Without even typing a password, you soon become stuck in a situation similar to the one below:

A typical Ubuntu login screen with an incorrectly configured common-auth file.

Placing the line at the bottom of the file fixes this problem. Proper order is maintained in this configuration; the first line jumps to or based on password validity, and by the time is reached, any incorrect password entries have already been indicated.

Even though is reached regardless of the password entered, the module will always fail if has been reached as well. This is because the line contains required; it will allow the rest of the lines to run, but the module itself will fail in the end.

For more information on how PAM works, you can google "How PAM works" or just go here:

That should do it!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.