What Do I Do If "The account is locked due to 3 failed logins" Is Reported When a Linux ECS Is Remotely Connected?

Symptom

When a Linux ECS is remotely connected, the message "The account is locked due to 3 failed logins" is displayed.

Figure 1 Error message

Possible Causes

When you remotely log in to the Linux ECS, consecutive incorrect password attempts trigger the restriction of the system PAM authentication module. As a result, the user is locked and cannot log in to the system.

Troubleshooting

1. (Optional) Unlock the root user.

   If the root user is locked, perform this step to unlock the root user. Otherwise, skip this step.

   1. Log in to the ECS in single-user mode.

      For details, see How Can I Boot a Linux ECS into Single-User Mode?

   2. Run the following commands in sequence to unlock the root user:

      pam_tally2 -u root #Check the number of consecutive incorrect password inputs of the root user.

      pam_tally2 -u root -r #Clear the number of consecutive incorrect password inputs of the root user.

      authconfig --disableldap --update # Update the PAM security authentication record.

   3. Run the following command to restart the ECS for the modification to take effect:

      reboot -f

2. Log in to the ECS as user root.

   For details, see Logging In to a Linux ECS Using VNC.

3. Run the following command to check whether the PAM configuration file contains authentication restrictions:

   pam_tally2 -u root #Check the number of consecutive incorrect password inputs of the root user.

   pam_tally2 -u root -r #Clear the number of consecutive incorrect password inputs of the root user.

   authconfig --disableldap --update # Update the PAM security authentication record.

   For example, if the following information is displayed, the common user and the root user can log in to the Linux instance again 30 seconds after they enter incorrect passwords for three consecutive times.

   Figure 2 Returned result
   

Solution

• Method 1: Wait for the freezing duration (for example, 50 seconds) set by PAM. After the system unfreezes the account, log in to the instance again.
• Method 2: Modify the configuration file.

  The following uses the /etc/pam.d/system-auth file as an example. The methods for modifying other configuration files are similar.

  1. Run the following command to open the /etc/pam.d/system-auth configuration file:

     vim /etc/pam.d/system-auth

  2. Press i to enter editing mode.
  3. Comment out, modify, or delete the configuration based on service requirements.
     In the configuration file, the following configuration indicates that a common user or the root user will be locked out after entering incorrect passwords for three consecutive times and will be unlocked 30 seconds later:

     auth required pam_tally2.so deny=3 unlock_time=30 even_deny_root root_unlock_time=30

     Comment out the configuration information:

     #auth required pam_tally2.so deny=3 unlock_time=30 even_deny_root root_unlock_time=30    # Commented-out code

     Configuration items:

     • deny=3: indicates the maximum number of consecutive incorrect login attempts allowed for common users and the root user. If this number is exceeded, the user is locked.
     • unlock_time=30: indicates the duration (in seconds) after which a locked common user is automatically unlocked.
     • even_deny_root: indicates that the root user is also restricted.
     • root_unlock_time=30: indicates the duration (in seconds) after which a locked root user is automatically unlocked.
     

     In this example, the pam_tally2 module is used. The configuration may vary according to the PAM version. For details, see Linux PAM SAG.