faillock
authentication failure tracking and lockout manager
TLDR
List login failures of current user
$ faillock
Reset failure records of current user$ faillock --reset
List login failures of all users$ sudo faillock
List failures of specific user$ sudo faillock --user [user]
Reset failures of specific user$ sudo faillock --user [user] --reset
SYNOPSIS
faillock [options]
DESCRIPTION
faillock displays and modifies authentication failure record files. Part of the PAM pam_faillock module, it tracks failed login attempts and can lock out accounts after too many failures.Used for security monitoring and account lockout management.
PARAMETERS
--user user
Operate on specific user--reset
Reset failure records--dir dir
Use alternate tally directory
CONFIGURATION
/etc/security/faillock.conf
Configuration for pam_faillock module including lockout thresholds and duration.
INSTALL
sudo apt install libpam-modules-bin
sudo apk add linux-pam
brew install linux-pam
nix profile install nixpkgs#linux-pam
CAVEATS
Part of the Linux-PAM package. Records stored in /var/run/faillock/ by default. Requires root to view other users' records.
SEE ALSO
pam_faillock(8), pam(8)