Unlocking User Account Lockouts in Linux Using PAM Tally

When administering highly secured Linux server farms across production data centers (such as east-dc1 or west-dc1), automated brute-force protections will instantly lock out user accounts after consecutive failed password attempts. While this protects against password attacks, legitimate users running expired SSH automation keys can accidentally trigger account lockouts, halting operational batch scripts.

In this practical sysadmin reference, I examine how to inspect active user authentication attempt logs and reset failed login counters using command-line PAM Tally utilities.

Step 1: Investigating Active Login Counter Surcharges

When an administrative user reports being unable to establish valid terminal sessions despite supplying correct authentication credentials (such as RandomPassword), verify whether local PAM access locks have been triggered.

# Display active failed login counters across target user identity
/sbin/pam_tally --user=targetuser

Reviewing Core Diagnostic Logs

Inspect secure authentication log destinations (/var/log/secure or /var/log/auth.log) to identify the exact source IP addresses associated with persistent authentication retries:

# Output failed authentication string occurrences
grep -i failed /var/log/secure

---

Step 2: Unlocking Locked Account Identifiers

To instantly clear accumulated invalid retry flags and restore account access, pass the reset parameter directly to the tally utility daemon.

# Reset invalid authentication try history flags
/sbin/pam_tally --user=targetuser --reset

Verifying Account Read-Back Clearing

Following a counter clearing action, invoke a validation check to ensure internal state flags have been successfully re-zeroed:

# Query active lockout statuses
/sbin/pam_tally --user=targetuser

User targetuser    (UID 1002)   0

References

• Linux Tally Authentication Module Specification
• Enterprise System Access and Authentication Management