PAM lockout threshold exceeded? Fix it here

1. The most common cause: pam_tally2 locked your user account

I know this error is infuriating – you're typing your password right, but the system says 'account locked'. This tripped me up the first time too. Usually it's because you (or an automated script) hit the failed login limit. On RHEL 7 and CentOS 7, the default limit is 3 tries with pam_tally2.so. Ubuntu 18.04 used pam_tally2 too. RHEL 8 and Ubuntu 20.04+ moved to pam_faillock, but the lockout behavior is the same.

How to fix it

First, check if you're locked. On the console (or via another admin account), run:

sudo pam_tally2 --user=your_username

If it shows a number above the deny threshold (often 3 or 5), you're locked. Reset it with:

sudo pam_tally2 --user=your_username --reset

For systems using pam_faillock (RHEL 8+, Ubuntu 20.04+), use:

sudo faillock --user your_username --reset

After resetting, try logging in again. If it still says locked, check /var/log/secure or /var/log/auth.log for the exact error message.

2. The config file is misconfigured or missing

Sometimes the problem isn't the lockout itself – it's that the PAM config is broken or missing. I've seen people edit /etc/pam.d/system-auth or /etc/pam.d/password-auth and mess up the order. The pam_tally2.so line must come before pam_unix.so in the auth section. Here's an example for RHEL 7:

auth        required      pam_tally2.so deny=3 unlock_time=300 onerr=fail
auth        sufficient    pam_unix.so nullok try_first_pass

If you're on an older system (RHEL 5/6), the config lives in /etc/pam.d/system-auth. Newer systems (RHEL 8+, Ubuntu 20.04+) use /etc/security/faillock.conf. Check that the file exists and has sensible values. A common mistake is setting deny=0 (which disables lockout) or unlock_time=0 (which locks forever until manual reset).

Quick test for config correctness

Run this to validate the PAM syntax:

pam_tally2 --help

If you get errors, your config is broken. Backup the original file and restore it from the distribution default. On RHEL/CentOS, you can reinstall the pam package:

sudo yum reinstall pam

But that overwrites your custom config, so note your settings first.

3. Root account got locked (yes, it happens)

Locking root is a special pain. Some distros (like Ubuntu) lock root by default for SSH, but on RHEL, you can lock the root account through PAM too. If you can't log in as root even from the console, and you see 'account locked' in the logs, here's what to do.

Recovery steps

Boot into single-user mode (or use a live CD). Mount your root filesystem. Then edit /etc/pam.d/system-auth and comment out the pam_tally2.so line temporarily. Reboot and log in as root, then fix the config properly.

Alternatively, if you have another sudo user, run:

sudo pam_tally2 --user=root --reset

But if root is locked and you have no other admin, you're stuck with the single-user method. That's why I always recommend having a second admin account.

Quick-reference summary

One last tip: set unlock_time=600 (10 minutes) for user accounts, and keep root exempted with even_deny_root disabled. You'll save yourself a lot of late-night unlocks.