Linux PAM & Faillock Account Lockout Policy Generator — Security Hardening Builder

[ 1. SECURITY PRESET PROFILES ]

Brute-Force Resilience

Max 3 Tries / 15m Lockout

[ HIGH RESILIENCE ]

[ 2. THRESHOLD & INTERVAL DIRECTIVES ]

Failed Attempts Threshold (deny): 3

Number of consecutive failed authentications before triggering an account lock.

Lockout Duration (unlock_time, sec): 900s (15 min)

Duration in seconds that the account remains locked (0 = manual admin unlock only).

Failure Observation Window (fail_interval, sec): 900s (15 min)

Window of time in seconds within which consecutive failures are tracked.

Root Lockout Duration (root_unlock_time, sec): 1800s (30 min)

Separate lockout duration specifically applied to the root account when even_deny_root is enabled.

[ ADVANCED SECURITY DIRECTIVES ]

even_deny_root: Enforce account lockout on the root user (prevents root brute-force attacks).

audit: Log username and failure count directly to the Linux audit subsystem (`auditd`).

silent: Suppress informative lockout messages to prevent username enumeration by attackers.

local_users_only: Apply lockout exclusively to local `/etc/passwd` accounts, bypassing LDAP/SSO.

nodelay: Suppress arbitrary PAM authentication delays on failed attempts (relies on faillock timing).

# Generating PAM Faillock configuration...

[ NOTE // DEPLOYMENT ]: On modern Linux distributions (Ubuntu 22.04+, Debian 12+, RHEL 8+, Rocky Linux 9+), configuring /etc/security/faillock.conf automatically applies to standard PAM stacks without manually editing /etc/pam.d/ files.

Architecture: Linux Pluggable Authentication Modules (PAM) & Faillock

The Linux Pluggable Authentication Modules (PAM) architecture provides dynamic, modular authentication abstraction across SSH, console login, `sudo`, and display managers. pam_faillock replaces the deprecated pam_tally2 module, tracking consecutive failed authentication attempts in transient tally databases under /var/run/faillock/ or /run/faillock/.

Key Security Directives Explained

even_deny_root & root_unlock_time

By default, PAM exempts the root account from lockout to prevent Denial-of-Service (DoS) attacks where an attacker intentionally locks out administrative access. Enabling even_deny_root combined with a dedicated root_unlock_time protects SSH jump hosts from root dictionary brute-force while allowing automated recovery.

silent & User Enumeration Defense

When an account is locked out, PAM can display explicit messages like "Account locked due to 3 failed logins". Enabling the silent directive suppresses these messages, preventing external attackers from identifying which usernames exist on the target system.

Managing Locked Accounts with the faillock CLI

Administrators can inspect and reset authentication tally records instantly without restarting any daemons:

# View authentication failure records for a user:
$ faillock --user devops_admin

# View failure records across all accounts:
$ faillock

# Reset / unlock a specific user account:
$ sudo faillock --user devops_admin --reset

# Reset all locked accounts on the host:
$ sudo faillock --reset