I mistyped my password several times on a console login and the account is now locked, with a message saying it is locked due to failed attempts.
I still have root access to the machine through another route, so I am not shut out entirely. I would rather not sit and wait for the timeout to expire.
What is the mechanism doing this, and how do I clear it properly rather than by rebooting?
The mechanism is a module in the authentication stack that counts consecutive failures per user and refuses further attempts for a configured period. It is not the account being disabled — the account is fine, there is simply a counter above the threshold.
Since you have root, clearing it is one command. The tool that manages the counter can show you the recorded failures for a user and reset them:
faillock --user yourname # show the recorded failures
faillock --user yourname --reset # clear them
Run that as root and the account is immediately usable again. No reboot, no waiting.
On systems using the older module the equivalent tool is pam_tally2, with the same idea — a listing option and a reset option. Which one you have depends on the distribution's vintage, and trying both costs nothing.
For the configuration side, since you will meet this again: the settings live in the authentication configuration, and the two numbers that matter are the failure threshold and the lockout duration.
Worth knowing that different distributions place these in different files and that some have a specific configuration file for the module. Editing authentication configuration is one of the easier ways to lock yourself out of a machine entirely, so the standard precaution applies: keep a root shell open in another terminal while you change anything, and test logging in from a third one before you close either.
That habit has saved me more than once, and the one time I skipped it cost me a trip to a data centre.
One thing that confuses people here: the lockout is usually per account, not per source.
So somebody else failing to log in as your username from elsewhere locks you out at the console. That is by design — the alternative would let an attacker keep trying from new addresses — and it means a lockout is not always evidence that you mistyped anything.
@ssh_serkan · 2w ago
Worth looking at the listing output before resetting rather than clearing it reflexively.
The record shows when each failure happened and from where. If the failures are all from your console in the last two minutes, that is you mistyping and there is nothing to think about.
If there are failures from times you were not at the machine, or from a network source, that is a different situation and the lockout just did its job. On a machine reachable from the internet, repeated failed attempts against a named account are routine background noise, and seeing them is a good prompt to check that password authentication is disabled for remote access in favour of keys.
So: read, then reset.
Reply
Report