pam_tally2

Install

# Typically included in pam or shadow-utils packages

# RHEL / Alma / Rocky (older releases)
sudo dnf install pam

# Debian / Ubuntu (older releases)
sudo apt install libpam-modules

# Modern systems may not include pam_tally2 (deprecated)

What it does

pam_tally2 displays and resets login failure counters maintained by the legacy pam_tally2.so PAM module. It was used to enforce account lockouts after repeated failed authentication attempts.

How it works (mechanical)

• Reads binary tally records (often in /var/log/tallylog).
• Tracks failed login attempts per user ID.
• Works only if pam_tally2.so is configured in PAM stack.
• Can reset counters to unlock accounts.
• Requires root privileges for modification.

Quick Start

# Show all user failure counts
sudo pam_tally2

10 Practical Examples

# 1) Show all users with failure counts
sudo pam_tally2

# 2) Show tally for a specific user
sudo pam_tally2 -u username

# 3) Reset failure counter for a user
sudo pam_tally2 -r -u username

# 4) Reset all counters (use with caution)
sudo pam_tally2 -r

# 5) Check if account is locked due to failures
sudo pam_tally2 -u username

# 6) Verify PAM configuration includes pam_tally2
grep pam_tally2 /etc/pam.d/*

# 7) Inspect tallylog file
ls -lh /var/log/tallylog

# 8) Compare with modern tool (faillock)
sudo faillock --user username

# 9) Unlock account after investigation
sudo pam_tally2 -r -u username

# 10) Check account status after reset
sudo pam_tally2 -u username
id username

Notes & Gotchas

• Deprecated: Many modern distributions replaced it with faillock.
• Only functions if pam_tally2.so is active in PAM configuration.
• Binary log file — do not edit manually.
• Resetting counters may affect audit trails.
• Always verify PAM stack before assuming lockout cause.

Historical Context

pam_tally2 replaced earlier tally mechanisms to provide configurable account lockout after repeated failures. It was widely used before distributions standardized on pam_faillock.

Modern Equivalent

Most modern systems use faillock with the pam_faillock.so module for more robust lockout handling. pam_tally2 is considered legacy and may be removed in newer releases.

Related Commands

• faillock — modern login failure tracking tool.
• faillog — view failure records.
• lastlog — view last successful login.
• passwd — manage user passwords.
• id — verify user identity and groups.