Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am trying to implement account lockout in ubuntu using pam_tally. I have tried adding the follwing lines in /etc/pam.d/common-auth

auth required pam_tally.so deny=3
account     required  pam_tally.so

The failures are getting logged but account is not getting locked even on reaching max failures. I am trying this by directly loggging in (GNOME login screen).

Any advices? Do I need to add in pam.d/gdm or login file also?

share|improve this question
Hello, this question has no information and activity for a very long time. I am voting to close it for now. If by any reason you think this question is still viable or useful in anyways or that there is still a good chance it will be answered please flag it to a moderator or add a comment with the reasons why you want it open. Regards. –  nitstorm Feb 28 '12 at 5:58

1 Answer 1

It has been a while since I looked at this, but

I think you need to edit /etc/pam.d/common-auth

Add this at the top of the file (order of rules matters).

auth required pam_tally.so per_user magic_root onerr=fail

You then set the number of allowed attempts

sudo faillog -m 3

To unlock an account

faillog -u login_name -r

for additional details see

My blog http://blog.bodhizazen.net/linux/ubuntu-how-to-faillog/

or man pam_tally

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.