Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a major problem with a fedora distribution (17). I don't know how to set up /etc/pam.d/system-auth in order to ban a user after he/she writes the password wrong (3 times)

I have read numerous different additions to this file that achieves this (all are about the same) but they dont work.

For example, I added these lines:

auth required onerr=fail deny=3 unlock_time=40

But the random user that I created can try his password numerous times without a warning , nothing.

How am I supposed to fix this? Does anyone have a suggestion?

share|improve this question
does it affect root/wheel users? –  Lorenzo Von Matterhorn Mar 31 '13 at 0:46
nope, no one :S –  Marcus Roerig Mar 31 '13 at 1:26

1 Answer 1

When PAM locks out a user account, it does not provide any message that the account is locked, so as to provide no additional information to attackers. as such, you will never get a warning that your account is locked out.

to test your settings, enter a good username and bad password 3 times. then enter the correct username and password within the 40 seconds you have the lock established for. if you are logged in, the settings failed, but if you get "Incorrect username or password" with the correct credentials, then everything is working correctly.

also, make sure your 'auth required ...' line precedes your 'auth sufficient ...' line.

for more hints, check here:

share|improve this answer
i am just switching users from GUI , but still same behavior.... stupid fedora . –  Marcus Roerig Mar 31 '13 at 2:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.