FAILLOCK(8)

📦
version 1.7.3 · 17 versions
, in arch rolling

✨ FAILLOCK ✨ (section 8, Linux-PAM Manual, bestie 💖)

okay so picture this: you're deep in the Linux-PAM manual pages, and you stumble onto faillock — and it's literally the tool for peeking at and messing with the authentication failure record files. yeah. the receipts. 🧾

🌸 NAME 🌸

faillock — the tool for displaying and modifying the authentication failure record files. no cap, that's the whole job.

🦋 SYNOPSIS 🦋

faillock [--dir /path/to/tally-directory] [--user username] [--reset]

that's it. three optional flags and you're the main character of your own account-lockout drama. 💅

🎀 DESCRIPTION 🎀

so the pam_faillock.so module is out here keeping a whole list of failed authentication attempts, per user, during a specified interval — and it locks the account in case there were more than deny consecutive failed authentications. dramatic? yes. necessary? also yes. 💀

and the way it stores those failure records? into per-user files in the tally directory. very organized. very demure. 🍓

now, the faillock command itself is an application you can use to examine and modify the contents of those tally files. it can show you the recent failed authentication attempts of the username, or it can clear the tally files — for all usernames or just individual ones. your call, bestie. 🫶

✨ OPTIONS ✨

  • --conf /path/to/config-file — the file where the configuration is located, fr. the default is /etc/security/faillock.conf. that's where the vibes (and the settings) live. 💜
  • --dir /path/to/tally-directory — the directory where the user files with the failure records are kept. the receipts folder, basically. 📁

the priority to set this option is: first, use the value provided from the command line. if that isn't provided, then the value from the configuration file is used. and finally, if neither of them has been provided, then /var/run/faillock is used. three-tier fallback, she's got layers. 👑

  • --user username — the user whose failure records should be displayed or cleared. name the person. be specific. 🎯
  • --reset — instead of displaying the user's failure records, clear them. poof. gone. clean slate energy. ✨

🌈 FILES 🌈

  • /var/run/faillock/* — the files logging the authentication failures for users. every single one of those little files is a paper trail. 🧾

🔥 SEE ALSO 🔥

go read them. iykyk. 📚

👑 AUTHOR 👑

faillock was written by Tomas Mraz. absolute legend, we stan. 🌟

and that's the whole page, bestie — go forth and check those tally files responsibly 💖

this has been the Linux-PAM manual page, dated 09/27/2026, section 8, and yeah — it ate. periodt. 💅✨

📦 where this page comes from