Linux password policy with pam_pwquality and account lockout with pam_faillock

PAM in brief

Pluggable Authentication Modules let each service stack modules for authentication, account checks, password changes, and sessions. pam_pwquality checks a new password’s strength when it is set. pam_faillock counts failed authentications and denies further attempts for a while after a threshold.

On RHEL-family systems, authselect manages the PAM files, so enable features through it rather than editing by hand. On Ubuntu, pam-auth-update handles profiles, and pwquality and faillock settings live in their own config files.

Password quality

In /etc/security/pwquality.conf, minlen sets the minimum length and dictcheck rejects dictionary words. Modern guidance from NIST SP 800-63B favors length over complexity rules and checking against known-breached passwords, so a minimum of 12 to 15 characters with dictionary checks is a sensible baseline.

Forced periodic rotation without evidence of compromise tends to produce predictable passwords. Expire passwords when you have reason to believe they leaked.

Snippet

# /etc/security/pwquality.conf
minlen = 14
dictcheck = 1
usercheck = 1
enforce_for_root

Lab: lockout and unlock

Enable faillock on a lab VM, set deny = 5 and unlock_time = 900 in /etc/security/faillock.conf, then fail an SSH or su login five times for a test user. Confirm the next correct password is refused. View the failures with faillock --user and reset them with faillock --user name --reset.

Consider the trade-off. Lockout stops guessing against one account but can be used to lock out real users on purpose. Pair it with rate limiting at the network edge and MFA for remote access.

Snippet

# RHEL / Fedora
sudo authselect enable-feature with-faillock
# Ubuntu: add pam_faillock lines via pam-auth-update or the documented profile
# /etc/security/faillock.conf
deny = 5
unlock_time = 900

sudo faillock --user testuser
sudo faillock --user testuser --reset

Where SSH fits

If SSH only allows key authentication, password policy matters less for remote logins but still protects local consoles, sudo prompts, and services using PAM. Do not assume one control covers all paths.

Log faillock events and alert on accounts that hit the threshold repeatedly. That pattern is either an attack or a broken script with an old password.

Diagram

A failed login through PAM

Attempt
A user enters a password at SSH, su, or the console.
Count
pam_faillock records the failure for that user.
Lock
After deny failures, further attempts are refused until unlock_time.
Reset
An administrator checks the cause and resets.
Command
```
faillock --user testuser --reset
```

Check yourself

1. Which setting raises the minimum password length in pwquality.conf?

2. What is a downside of aggressive account lockout?

3. How do you clear a user’s failure count?