How to Configure pam_faillock in Ubuntu to Lock Accounts After Failed Authentication Attempts

Public-facing Linux servers and corporate workstations are subjected to constant automated credential stuffing and brute-force attacks against SSH, local console logins, and display managers. While SSH key authentication mitigates remote password guessing, local console access, virtual terminal sessions, and sudo elevation interfaces remain vulnerable to repeated dictionary attacks if account lockout policies are not strictly enforced.

In modern Linux distributions—including Ubuntu 22.04 LTS and Ubuntu 24.04 LTS—the legacy pam_tally2 module has been fully deprecated and removed. It has been superseded by pam_faillock, a robust Pluggable Authentication Module (PAM) designed to track failed authentication attempts per user and temporarily lock the account once a defined threshold is reached. Configuring pam_faillock protects system integrity while granting administrators complete control over lockout thresholds, unlock timers, and administrative overrides.

Understanding pam_faillock Architecture

The pam_faillock module maintains authentication attempt logs within temporary runtime memory located at /var/run/faillock/ (or /run/faillock/). When an authentication challenge occurs:

• Pre-Authentication (auth preauth): The module checks whether the user account is currently in a locked state due to prior consecutive failures. If the lockout timer is active, authentication is rejected immediately without prompting for or verifying the password, mitigating timing attacks.
• Authentication Verification (auth pam_unix.so): The user’s provided credentials are verified against the shadow password database.
• Failure Accounting (auth fail): If password verification fails, pam_faillock increments the failure counter for that specific user.
• Success Reset: If authentication succeeds, the failure log for that user is automatically cleared, resetting the threshold counter.

Configuring Global Lockout Policies in faillock.conf

In Ubuntu, global configuration parameters for pam_faillock are centralized in /etc/security/faillock.conf. Open this file in your text editor with administrative privileges:

sudo nano /etc/security/faillock.conf

Configure the following primary security directives according to your organization’s compliance policy:

# The number of consecutive failures allowed before account lockout
deny = 5

# Time window in seconds during which consecutive failures are accumulated (15 minutes)
fail_interval = 900

# Duration in seconds the account remains locked (10 minutes)
unlock_time = 600

# Do not lock the root account (essential to avoid lockout denial-of-service)
# Alternatively, set 'even_deny_root' if root lockout is required by compliance
# even_deny_root

# Root lockout duration if even_deny_root is active
root_unlock_time = 900

# Audit log message directory
dir = /run/faillock

Save and close the file. Centralising settings in faillock.conf ensures that policies persist cleanly even when PAM packages are upgraded by apt.

Integrating pam_faillock into Ubuntu PAM Stack

To enforce the parameters defined in faillock.conf, update the PAM common authentication profile. Ubuntu manages PAM configuration profiles using pam-auth-update, but manual configuration of /etc/pam.d/common-auth ensures explicit rule ordering.

First, create a backup of the existing configuration:

sudo cp /etc/pam.d/common-auth /etc/pam.d/common-auth.bak

Open /etc/pam.d/common-auth:

sudo nano /etc/pam.d/common-auth

Position pam_faillock.so rules before and after pam_unix.so as shown below:

# Check if account is already locked
auth    required    pam_faillock.so preauth

# Standard Unix password verification
auth    [success=1 default=ignore]    pam_unix.so nullok

# Count failure if pam_unix fails
auth    [default=die]    pam_faillock.so authfail

# Reset counter on successful authentication
auth    sufficient    pam_faillock.so authsucc

Save the file. The changes take effect immediately across all PAM-aware services, including local TTY terminals, graphical display managers, and SSH logins.

Auditing and Inspecting Failed Login Attempts

The companion CLI utility faillock allows administrators to inspect lockouts, view failure timestamps, and identify brute-force targets.

To inspect failed attempts for all users across the system:

sudo faillock

To inspect the status of a specific user account:

sudo faillock --user johndoe

If an account has accumulated failed attempts, faillock outputs a detailed event log:

johndoe:
When                Type  Source  Valid
2026-11-07 08:12:01 TTY   pts/0   V
2026-11-07 08:12:15 TTY   pts/0   V
2026-11-07 08:12:28 TTY   pts/0   V
2026-11-07 08:12:40 TTY   pts/0   V
2026-11-07 08:12:55 TTY   pts/0   V

Once the count reaches the configured deny threshold (e.g., 5), subsequent authentication requests are rejected automatically until the unlock_time timer expires.

Manually Unlocking a Locked User Account

If a legitimate user is locked out and requires immediate access before the automatic unlock timer elapses, an administrator can reset their failure records manually:

sudo faillock --user johndoe --reset

Verify that the failure ledger has been cleared:

sudo faillock --user johndoe

The terminal confirms zero recorded failures, restoring immediate access.

Implementing pam_faillock on Ubuntu provides robust protection against brute-force password guessing, significantly hardening Linux environments against unauthorized access.