Managing User Account Lockouts in Linux: A Guide to pam_tally2 and pam_faillock

Servers
, ,
1

Linux servers require robust security measures, particularly to protect against brute force attacks. Managing failed login attempts is crucial, and tools like pam_tally2 and pam_faillock are instrumental in this process. Understanding which tool to use and how to apply it can significantly enhance your system’s security.

Understanding pam_tally2 and pam_faillock

  • pam_tally2: This module is part of older Linux distributions and is used to track and limit the number of failed login attempts. It allows administrators to lock user accounts after a specified number of failed attempts. While effective, pam_tally2 is deprecated in newer distributions like RHEL/CentOS 7 and later.

  • pam_faillock: As a successor to pam_tally2, pam_faillock offers more features and enhanced security measures. It is included in recent Linux distributions such as RHEL 7+, Fedora, and others that employ a modern PAM system.

Implementing Account Unlock Procedures

For pam_tally2:

To unlock an account or reset the failed login attempts counter in distributions that still support pam_tally2, use:

pam_tally2 --reset --user=username

For pam_faillock:

In newer distributions, pam_faillock takes over with additional capabilities. To manage lockouts, you can use:

faillock --reset --user=username

This command resets all failed login attempts for the specified user.

Choosing the Right Tool

Selecting between pam_tally2 and pam_faillock depends largely on your distribution:

  • Older Versions: Distributions like earlier versions of CentOS and RHEL, which still support pam_tally2, can use this module for basic account lockout functionality.

  • Newer Versions: For newer systems, especially those based on RHEL 7 and above, pam_faillock is recommended due to its updated feature set and ongoing support.

Conclusion

Both pam_tally2 and pam_faillock are powerful tools for managing security on Linux servers. Knowing how to effectively use these tools to unlock accounts and manage failed login attempts is essential for maintaining both security and user accessibility. Regular updates and adherence to the latest security practices are recommended to ensure the integrity and safety of your systems.