pam_tally2 command not found RHEL 8 – Deprecated

by Ravi Kumar Ankam · October 1, 2019

pam_tally2 command not found RHEL 8 because command pam_tally2 is deprecated and replaced by faillock command.

This module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail. pam_tally2 comes in two parts: pam_tally2.so and pam_tally2. The former is the PAM module and the latter, a stand-alone program. pam_tally2 is an (optional) application which can be used to interrogate and manipulate the counter file. It can display users’ counts, set individual counts, or clear all counts. Setting artificially high counts may be useful for blocking users without changing their passwords. For example, one might find it useful to clear all counts every midnight from a cron job.

Normally, failed attempts to access root will not cause the root account to become blocked, to prevent denial-of-service: if your users aren’t given shell accounts and root may only login via su or at the machine console (not telnet/rsh, etc), this is safe.

pam_tally2 command not found in RHEL 8

The pam_faillock.so module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny consecutive failed authentications. It stores the failure records into per-user files in the tally directory (/var/run/faillock).

The faillock command is an application which can be used to examine and modify the contents of the the tally files. It can display the recent failed authentication attempts of the username or clear the tally files of all or individual usernames.

Use below command to see failed count