Lion Cipher Lab
Enforce account lockout against brute force with pam_faillock
- Identity & Access Management
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Online password-guessing and credential stuffing hammer a single account with attempt after attempt until something works. Account lockout is the classic defense: after a handful of wrong passwords, the account stops answering for a cooldown, so an attacker can't grind through a password list. pam_faillock is the standard Linux module that enforces this on the login path. But lockout is double-edged — set it wrong and you hand an attacker a way to deny service to your users. Learning to configure it, prove it, read its tally, and judge the trade-off is core IAM hygiene for any Linux box you…
What you'll learn
- Linux PAM configuration
- account lockout policy
- pam_faillock
- reading and resetting the faillock tally
- reasoning about lockout DoS trade-offs
Steps in this lab
- Read this first: do it in a throwaway box
- Create a test user you can safely lock
- BEFORE — prove there is no lockout yet
- Configure the policy in faillock.conf
- Wire pam_faillock into the login path
- AFTER — trigger the lockout and read the tally
- Reset the lock and confirm login works again
- The judgment — a double-edged sword