56

After trying to login with the wrong password, my account is locked. When logging in on a TTY console I get the following message

mylaptop login: myUsername
The account is locked due to 3 failed logins.
(10 minutes left to unlock)
Password:

I am on Manjaro linux. I still have root access to this device.

How do unlock my user without waiting 10 minutes?

Improve this question

3 Answers 3

Reset to default
74

If you still have access to the system by another account
root or some other account with root-like (sudo?) privileges

  1. You can view the failed logins with faillock
    # faillock --user myUsername
myUsername:
When            Type     Source     Valid
Timestamp 1     TTY      /dev/tty1  V
Timestamp 2     TTY      /dev/tty1  V
Timestamp 3     TTY      /dev/tty1  V
  1. Reset them with the --reset-flag
    # faillock --user myUsername --reset
# faillock --user myUsername
myUsername:
When            Type     Source     Valid

If you've found another way to access the file system
through a rescue disk or someone else's computer

  1. Navigate to /var/run/faillock (*), this folder should contain a file with the locked username

    # ls /var/run/faillock
myUsername

  2. Remove the file with the username to unlock

    # rm /var/run/faillock/myUsername

*) This is called 'tally directory' and its location depends on your system's configuration, which is likely to be found at /etc/security/faillock.conf

Improve this answer
5
  • 5
    This is a really good answer and should be accepted.
    – CR.
    Sep 1, 2021 at 20:54
  • Strangely enough, removing the entry for my username under the /run/faillock directory does not unlock the account. The --reset command works though.
    – Fopedush
    Jul 6, 2022 at 16:30
  • I've just tried and deleting the /run/faillock/myUsername-file still works on my machine. Apparently there are some configurations (some form of disk caching would be my first guess) that affect this behavior. Good to keep in mind.
    – Joost
    Jul 12, 2022 at 20:11
  • instead of deleting manually let faillock handle it. Use command faillock --reset --user <user> --dir <tally dir path>
    – Vijay S B
    Sep 16, 2022 at 13:26
  • @VijaySB that is the preferred way and that is why it is part 1 of this answer
    – Joost
    Sep 16, 2022 at 13:32
10

"sudo" and "faillock" - How to handle "The account is locked due to X failed logins."

If you still have access with root-like privileges, you can view the failed logins...

faillock --user [USERNAME]

... and/or reset attempts status...

faillock --user [USERNAME] --reset

PLUS:

You can change the possible attempts number before a lock by uncommenting and changing the parameter...

# deny = 3

... in the file...

vi /etc/security/faillock.conf

Normally faillock automatically unlocks the account after 10 minutes (600 seconds), but you can change that too...

# unlock_time = 600

[Ref(s).: https://forum.manjaro.org/t/how-to-remove-or-increase-password-attempts/47986/2?u=eduardolucioac ]

Improve this answer
0

By default tally log is present in /var/run/faillock. If it is configured in /etc/security/faillock.conf to write in different path, then use below command.

faillock --reset --user <user> --dir <tally dir path>

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .