How to Check and Reset Failed Login Attempts in Linux Terminal Using faillog

To defend against automated SSH brute-force attacks and credential stuffing, Linux systems maintain detailed audit logs of unsuccessful authentication attempts. While graphical user interfaces rarely report low-level authentication tallies, the Linux faillog utility provides system administrators with direct command-line access to the system’s tally database (typically stored in /var/log/faillog). Using faillog, you can audit user login failures, inspect lockout counters, establish failure thresholds, and instantly unlock locked accounts.

Understanding How faillog and PAM Interact

In modern Linux distributions, user authentication is brokered by Pluggable Authentication Modules (PAM). Modules such as pam_tally2, pam_faillock, or the legacy pam_tally increment a recorded failure counter each time an incorrect password is submitted for a local account. The faillog tool reads directly from this binary record to report:

• Username: The targeted local user account.
• Failures: The cumulative count of consecutive bad password entries.
• Maximum: The threshold of failed attempts permitted before PAM disables the account. A value of 0 indicates no lockout limit.
• Latest: The exact timestamp of the most recent authentication failure.
• On: The terminal line (e.g. tty1 or pts/0) or host IP address from which the failed attempt originated.

Auditing Failed Logins for All Users

To view an overview of all user accounts on your system that have recorded authentication failures, run faillog with root privileges:

sudo faillog -a

The -a (all) flag instructs the command to display every user account that currently has a non-zero failure count. Accounts that have never experienced a failed login or whose counters were recently cleared are excluded from output to reduce clutter.

Checking Authentication Failures for a Specific User

If a specific user reports being locked out of their workstation or SSH shell, you can query their individual account status using the -u flag:

sudo faillog -u username

This displays the user’s exact failure tally, the time of their last failed attempt, and whether their failure count has breached the system’s maximum threshold.

How to Reset Failed Login Counters (Unlocking Accounts)

When an account locks after exceeding the maximum allowable failure threshold, administrators can reset the tally back to zero to restore immediate access:

sudo faillog -r -u username

The -r (reset) flag clears the failure count recorded in the database. The user can immediately authenticate again with their correct password without waiting for a time-based lockout penalty to expire.

Configuring Maximum Failure Thresholds and Lockout Times

You can also use faillog to set defensive account locking policies directly from the terminal:

• Set Maximum Failed Attempts: To enforce an account lockout after 5 consecutive failed login attempts for a specific user:

  sudo faillog -m 5 -u username

• Apply Lockout Threshold Globally: To enforce a 5-attempt limit across all existing users:

  sudo faillog -m 5

• Set Lockout Duration: To automatically unlock an account after a designated cooldown period (for example, 900 seconds / 15 minutes):

  sudo faillog -l 900 -u username

Modern PAM Alternatives: faillock and pam_faillock

On newer distributions using systemd and updated PAM stacks (such as RHEL 8/9, Fedora, and recent Ubuntu releases), faillog is often complemented or superseded by faillock:

• Audit Failures via faillock: sudo faillock --user username
• Reset Lockout via faillock: sudo faillock --user username --reset

Both utilities perform complementary roles in maintaining server security, giving administrators clear visibility into brute-force attempts and an immediate remediation path for locked users.