FAILLOCK.CONF(5)

💖 FAILLOCK.CONF(5) 💖

okay bestie, so this is the faillock.conf manual page, from the Linux-PAM Manual — aka the glow-up guide for pam_faillock configuration. sit down, grab a boba, we're doing this 🧋✨

---

🌸 NAME 🌸

faillock.conf — the config file for pam_faillock 🎀

---

✨ DESCRIPTION ✨

so faillock.conf is literally the main character of "how do we lock a user out after they keep fumbling their password" 💅 it gives you a whole way to configure the default settings for locking someone's account after multiple failed authentication attempts. the pam_faillock module reads this file, and ngl, this is the preferred method — like, way better than configuring pam_faillock directly. periodt.

the file format is giving simplicity, honestly. it's just name = value, super simple, and you can drop comments in there starting with the # character. and the whitespace? it does NOT matter — whitespace at the beginning of the line, at the end of the line, and around the = sign is all ignored. she's chill like that 🦋

---

👑 OPTIONS 👑

• dir=/path/to/tally-directory — the directory where the user files holding the failure records live. default is /var/run/faillock. 🗂️

note: on systems configured with the directory /var/run/faillock mounted on virtual memory, these files will disappear after reboot. yes bestie, they vanish. poof. 💀

• audit — will log the user name into the system log if the user is not found. 🔍
• silent — don't print informative messages to the user. but wait — please note that when this option is not used, there will be a difference in the authentication behavior for users which exist on the system versus non-existing users. so yeah, that's a whole thing 🙈
• no_log_info — don't log informative messages via syslog(3). 🤫
• local_users_only — only track failed user authentications attempts for local users in /etc/passwd, and ignore centralized (AD, IdM, LDAP, etc.) users. the faillock(8) command will also no longer track user failed authentication attempts. enabling this option will prevent a double-lockout scenario where a user is locked out locally and in the centralized mechanism. no double trouble, we love that for you 🫶
• nodelay — don't enforce a delay after authentication failures. bye latency 👋
• deny=n — deny access if the number of consecutive authentication failures for this user during the recent interval exceeds n. default is 3. three strikes, bestie ⚾
• fail_interval=n — the length of the interval during which the consecutive authentication failures must happen for the user account lock out is n seconds. default is 900 (that's 15 minutes, we did the math for you 🧮).
• unlock_time=n — the access will be re-enabled after n seconds after the lock out. the value 0 has the same meaning as the value never — the access will not be re-enabled without resetting the faillock entries by the faillock(8) command. default is 600 (10 minutes, cutie ⏰).

note that the default directory that pam_faillock uses is usually cleared on system boot, so the access will be also re-enabled after system reboot. if that is undesirable, a different tally directory must be set with the dir option. 👀

also note that it is usually undesirable to permanently lock out users, as they can become easily a target of denial of service attack unless the usernames are random and kept secret to potential attackers. so like, don't do that fr fr 😭

• even_deny_root — root account can become locked as well as regular accounts. nobody is safe, not even root 👑
• root_unlock_time=n — this option implies the even_deny_root option. allow access after n seconds to the root account after the account is locked. in case the option is not specified, the value is the same as of the unlock_time option. ✨
• admin_group=name — if a group name is specified with this option, members of the group will be handled by this module the same as the root account (the options even_deny_root and root_unlock_time will apply to them). by default the option is not set. 💜

---

🌈 EXAMPLES 🌈

here's the /etc/security/faillock.conf file example, chef's kiss:

deny=4
unlock_time=1200
silent

---

🎀 FILES 🎀

• /etc/security/faillock.conf — the config file for custom options 📁

---

🦋 SEE ALSO 🦋

faillock(8), pam_faillock(8), pam.conf(5), pam.d(5), pam(8) — go read these too, they're all in the friend group 💕

---

⭐ AUTHOR ⭐

pam_faillock was written by Tomas Mraz. the support for faillock.conf was written by Brian Ward. absolute icons, we stan 👏💖

---

and that's the whole page, bestie!! this came from Linux-PAM, dated 09/27/2026 — love that for us. now go configure your faillock responsibly, mwah 💋🌸