Information
Lock out userIDs after n unsuccessful consecutive login attempts. The first set of changes are made to the main PAM configuration file /etc/pam.d/system-auth. The second set of changes are applied to the program specific PAM configuration file (in this case, the ssh daemon). The second set of changes must be applied to each program that will lock out userID's.
Set the lockout number to the policy in effect at your site.
Rationale:
Locking out userIDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.
Solution
# sed -i '5iauthrequiredpam_tally2.so deny=5 onerr=fail'
/etc/pam.d/system-auth
Note:
If a user has been locked out because they have reached the maximum consecutive failure count defined by deny= in the pam_tally2.so module, the user can be unlocked by issuing the command:
# /usr/sbin/pam_tally2 -u --reset=0
This command sets the failed tally count to 0, effectively unlocking the userid.
Default Value:
OS Default: N/A