How to Lock User After Failed Attempts

Step 1: Install pam_tally2

sudo apt install libpam-modules -y

Step 2: Configure PAM for SSH

sudo nano /etc/pam.d/sshd

Add before the line with @include common-auth:

auth required pam_tally2.so deny=5 unlock_time=900 onerr=succeed

Step 3: For Local Login

Add to /etc/pam.d/login.

Step 4: Check Failed Counts

sudo pam_tally2 --user username

Step 5: Reset Counter Manually

sudo pam_tally2 --user username --reset