Linux  ·  high  ·  Access, hardening & packages

Accounts locked out — faillock, pam_tally and expired passwords

Authentication is being refused by PAM before the password is even considered — a lock, an expiry, or a shell that prevents login.

What you see

A correct password is rejected. The message may mention a lock, or may be a generic authentication failure with the real reason only in the log.

What is actually wrong

Failed attempt counters that have reached their limit, a password or account expiry date that has passed, or an account whose shell has been set to nologin.

Codes and articles

Account locked due topam_faillockpam_tally2Your account has expiredAuthentication failurepassword expired

Fixes (3)

Read what PAM actually rejected
Root shell15 minuteslow riskreversible

Always start here — the reason is logged and guessing wastes time.

  1. Read the authentication log for the exact refusal.

    Shell
    sudo journalctl -t sshd -t sudo -t login --since '30 min ago' --no-pager | tail -40sudo tail -60 /var/log/auth.log 2>/dev/null || sudo tail -60 /var/log/secure

  2. Check the account's state directly.

    Shell
    sudo passwd -S usernamesudo chage -l usernamegetent passwd username

    passwd -S shows L for locked, P for a usable password and NP for none. chage -l shows every expiry date. Between them they answer this in ten seconds without touching a configuration file.

  3. Check the shell — an account with /usr/sbin/nologin or /bin/false authenticates and is immediately disconnected, which looks like a rejected password.

    Shell
    getent passwd username | cut -d: -f7

  4. Check the account is not simply absent from a required group or an AllowUsers list in sshd.

Confirm it workedYou have a named reason to act on.
If you need to undo itNothing was changed.
Clear the failed attempt counter
Root shell15 minutesmedium riskreversible

Too many failed attempts.

  1. See the counter and when it will clear on its own.

    Shell
    sudo faillock --user usernamesudo pam_tally2 --user username 2>/dev/null

  2. Reset it.

    Shell
    sudo faillock --user username --reset

  3. Find out what caused the failures before assuming it was the user. A saved credential in a phone or a scheduled task retrying an old password will lock the account again within minutes.

    Shell
    sudo journalctl -t sshd --since '2 hours ago' | grep -i 'failed password' | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head

    Repeated lockouts are almost never the person typing. The source address in the log names the device or service that is still trying the old password, and that is the thing to fix.

  4. Review the policy if lockouts are frequent — the defaults in /etc/security/faillock.conf are often stricter than intended.

    Shell
    grep -vE '^\s*#|^\s*$' /etc/security/faillock.conf

  5. Consider whether the account should be exposed to the internet at all. Key-only SSH removes password lockouts entirely.

Confirm it workedThe user signs in and the counter stays at zero.
Shell
sudo faillock --user username
If you need to undo itThe counter rebuilds naturally; policy changes can be reverted in faillock.conf.
Deal with an expired password or account
Root shell15 minutesmedium riskreversible

An expiry date has passed.

  1. Read all the dates at once.

    Shell
    sudo chage -l username

  2. An expired password can be changed at login; an expired account cannot log in at all. They are separate fields and the distinction matters.

  3. Extend or clear the account expiry.

    Shell
    sudo chage -E -1 username

  4. Force a password change at next login rather than setting a password on the user's behalf.

    Shell
    sudo chage -d 0 username

    Setting a password for someone means you know it. Expiring it forces them to set their own at the next login, which keeps the credential theirs.

  5. Unlock the account if it was locked.

    Shell
    sudo usermod -U usernamesudo passwd -S username

  6. Check the account is not simply disabled by an exclamation mark in the shadow file, which usermod -U clears.

Confirm it workedchage -l shows no expired fields and the user can sign in.
Shell
sudo chage -l username; sudo passwd -S username
If you need to undo itchage -E with the original date restores the expiry.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.