Account Lockout on Failed Logins with pam_tally2 / pam_faillock
Unthrottled authentication services are susceptible to online credential brute forcing and password spraying attacks. While tools like fail2ban monitor application logs to block IP addresses at the firewall layer, PAM modules enforce account lockouts at the OS level across all authentication entry points (SSH, TTY consoles, display managers, and su). Historically handled by pam_tally2 (and superseded in RHEL 8+ / Debian 11+ by pam_faillock), this module tracks failed attempts and locks accounts for a specified duration. ...