65

After trying to login with the wrong password, my account is locked. When logging in on a TTY console I get the following message

mylaptop login: myUsername
The account is locked due to 3 failed logins.
(10 minutes left to unlock)
Password: 

I am on Manjaro linux. I still have root access to this device.

How do unlock my user without waiting 10 minutes?

3 Answers 3

86

If you still have access to the system by another account
root or some other account with root-like (sudo?) privileges

  1. You can view the failed logins with faillock
    # faillock --user myUsername
    myUsername:
    When            Type     Source     Valid
    Timestamp 1     TTY      /dev/tty1  V
    Timestamp 2     TTY      /dev/tty1  V
    Timestamp 3     TTY      /dev/tty1  V
    
  1. Reset them with the --reset-flag
    # faillock --user myUsername --reset
    # faillock --user myUsername
    myUsername:
    When            Type     Source     Valid
    

If you've found another way to access the file system
through a rescue disk or someone else's computer

  1. Navigate to /var/run/faillock (*), this folder should contain a file with the locked username

    # ls /var/run/faillock
    myUsername
    
  2. Remove the file with the username to unlock

    # rm /var/run/faillock/myUsername

*) This is called 'tally directory' and its location depends on your system's configuration, which is likely to be found at /etc/security/faillock.conf

5
  • 5
    This is a really good answer and should be accepted.
    – CR.
    Sep 1, 2021 at 20:54
  • Strangely enough, removing the entry for my username under the /run/faillock directory does not unlock the account. The --reset command works though. Jul 6, 2022 at 16:30
  • I've just tried and deleting the /run/faillock/myUsername-file still works on my machine. Apparently there are some configurations (some form of disk caching would be my first guess) that affect this behavior. Good to keep in mind.
    – Joost
    Jul 12, 2022 at 20:11
  • instead of deleting manually let faillock handle it. Use command faillock --reset --user <user> --dir <tally dir path>
    – Vijay S B
    Sep 16, 2022 at 13:26
  • @VijaySB that is the preferred way and that is why it is part 1 of this answer
    – Joost
    Sep 16, 2022 at 13:32
14

"sudo" and "faillock" - How to handle "The account is locked due to X failed logins."

If you still have access with root-like privileges, you can view the failed logins...

faillock --user [USERNAME]

... and/or reset attempts status...

faillock --user [USERNAME] --reset

PLUS:

You can change the possible attempts number before a lock by uncommenting and changing the parameter...

# deny = 3

... in the file...

vi /etc/security/faillock.conf

Normally faillock automatically unlocks the account after 10 minutes (600 seconds), but you can change that too...

# unlock_time = 600

[Ref(s).: https://forum.manjaro.org/t/how-to-remove-or-increase-password-attempts/47986/2?u=eduardolucioac ]

0

By default tally log is present in /var/run/faillock. If it is configured in /etc/security/faillock.conf to write in different path, then use below command.

faillock --reset --user <user> --dir <tally dir path>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .