Use Pam_Tally2 to Lock and Unlock SSH Failed Login Attempts

pam_tally2 module is used to lock user accounts after certain number of failed ssh login attempts made to the system. This module keeps the count of attempted accesses and too many failed attempts.

pam_tally2 module comes in two parts, one is pam_tally2.so and another is pam_tally2. It is based on PAM module and can be used to examine and manipulate the counter file. It can display user login attempts counts, set counts on individual basis, unlock all user counts.

Lock SSH Logins

Pam_tally2 to Lock SSH Logins

By default, pam_tally2 module is already installed on the most of the Linux distributions and it is controlled by PAM package itself. This article demonstrates on how to lock and unlock SSH accounts after reaching a certain failed number of login attempts.

How to Lock and Unlock User Accounts

Use ‘/etc/pam.d/password-auth‘ configuration file to configure login attempts accesses. Open this file and add the following AUTH configuration line to it at beginning of the ‘auth‘ section.

auth        required      pam_tally2.so  file=/var/log/tallylog deny=3 even_deny_root unlock_time=1200

Next, add the following line to ‘account‘ section.

account     required      pam_tally2.so
Parameters
  1. file=/var/log/tallylog – Default log file is used to keep login counts.
  2. deny=3 – Deny access after 3 attempts and lock down user.
  3. even_deny_root – Policy is also apply to root user.
  4. unlock_time=1200 – Account will be locked till 20 Min. (remove this parameters if you want to lock down permanently till manually unlock.)

Once you’ve done with above configuration, now try to attempt 3 failed login attempts to server using any ‘username‘. After you made more than 3¬†attempts you will get the following message.

[[email protected] ~]# ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Account locked due to 4 failed logins
Account locked due to 5 failed logins
Last login: Mon Apr 22 21:21:06 2013 from 172.16.16.52

Now, verify or check the counter that user attempts with the following command.

[[email protected] ~]# pam_tally2 --user=tecmint
Login           Failures  Latest    failure     From
tecmint              5    04/22/13  21:22:37    172.16.16.52

How to reset or unlock the user account to enable access again.

[[email protected] pam.d]# pam_tally2 --user=tecmint --reset
Login           Failures  Latest    failure     From
tecmint             5     04/22/13  17:10:42    172.16.16.52

Verify login attempt is reset or unlocked

[[email protected] pam.d]# pam_tally2 --user=tecmint
Login           Failures   Latest   failure     From
tecmint            0

The PAM module is part of all Linux distribution and configuration provided about should work on all Linux distribution. Do ‘man pam_tally2‘ from the command line to know more about it.

Read Also:

  1. 5 Tips to Secure and Protect SSH Server
  2. Block SSH Brute Force Attacks Using DenyHosts

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

Support Us

We are thankful for your never ending support.

Narad Shrestha

He has over 10 years of rich IT experience which includes various Linux Distros, FOSS and Networking. Narad always believes sharing IT knowledge with others and adopts new technology with ease.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

22 Responses

  1. Kogulakannan says:

    I have a requirement that I need to add 2 new users in a Rhel 7.x. On the first 60 days only they need Sudo/privileged access and after the standard user Access is enough. How to fulfill the same.

  2. RichX says:

    This worked like a charm to unlock a locked account due to excessive failed logons!

    However in a RHEL 5.11 server pam_tally2 seems not working well as pam_tally does, which means I have to use pam_tally to unlock such an account.

    pam_tally --user= --reset
    
  3. Omar Chiquito says:

    This save me yesterday in a critical situation :)

Leave a Reply to RichX Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.