1、
Make sure the counter is set to zero
Attempt deny number of logins using wrong password, so the account is locked.
Wait for unlock_time
check the counter using pam_tally2, it shows the number of failures instead of zero.
2、
The problem with /etc/pam.d/system-auth is that it contains modules that are not usable in remote configurations so remote services such as sshd, vsftpd now use /etc/pam.d/password-auth.
3、pam_tally2计数器
pam_tally2 does not reset the counter immediately after unlock_time, the counter would be set to zero on next successful login.
4、pam_faillock does not unlock account
pam_faillock (PAM Module) reads configuration file /etc/security/faillock.conf. However, faillock command does not read the config file. Therefore, the option must be manually set as command line parameter.
解决方法：
If dir option is used in pam_faillock, supply the faillock directory as command line option:
Raw
faillock --dir /var/log/faillock --user bob
faillock --dir /var/log/faillock --user bob --reset
5 SSHD configuration adjustment
If pam_faillock.so is not working as expected, the following changes may have to be made to SSHD’s configuration:
Raw
vi /etc/ssh/sshd_config**ChallengeResponseAuthentication yes
Then restart the sshd service in order for these configuration changes to take effect:
Raw
systemctl restart sshd
