How to Set Up Account Lockout Policy

Step 1: Install libpam-modules

sudo apt install libpam-modules -y

Step 2: Configure faillock

sudo nano /etc/security/faillock.conf

Set:

deny = 5
unlock_time = 900
even_deny_root
root_unlock_time = 1800

Step 3: Enable in PAM

sudo nano /etc/pam.d/common-auth

Add:

auth required pam_faillock.so preauth
auth required pam_faillock.so authfail
auth required pam_faillock.so account

Step 4: Check Locked Accounts

sudo faillock

Step 5: Unlock User

sudo faillock --user username --reset