Error Description

The error “Account locked due to XXX failed logins” appears before I enter the login password.

Possible Reasons

This issue may be caused by the pam_tally2.so configuration in /etc/pam.d/login file. For VNC login, /etc/pam.d/login is called for authentication, while pam_tally2.so indicates to automatically lock the user account temporarily or permanently after the specified number of consecutive failed logins. When an account is permanently locked, you need to unlock it manually.

The login account will be locked when the number of consecutive failed logins exceeds the configured value. Note that the account may also be locked for brute force attacks.

See below for the parameters of pam_tally2 module.

Solutions

1. Refer to troubleshooting procedure to access the login configuration file and temporarily comment out the configuration of the pam_limits.so module.
2. Find the reason why your account is locked, and improve your security policy.

Troubleshooting Procedure

1. Try to log in to Linux CVM via SSH key.
   • If the login succeeded, proceed to the next step.
   • If the login failed, try the single user mode.
2. Run the following command to view logs.

   vim /var/log/secure
   

   This file records the security information, mostly CVM login logs. You can check the error logs of pam_tally2 as shown below.
   
3. Run the following commands in sequence to open /etc/pam.d directory and search for pam_tally2.

   cd /etc/pam.d
   

   find . | xargs grep -ri "pam_tally2" -l
   

   If the result similar to the following figure is returned, pam_tally2 is included in login file.
   
4. Run the following command to temporarily comment out the pam_tally2.so configurations. Then you can log in normally.

   sed -i "s/.*pam_tally.*/#&/" /etc/pam.d/login
   

5. Check whether the account is locked due to misoperations or brute force attacks. In the later case, it is recommended to strengthen the security policy as follows:
   • Change the CVM password to a stronger password containing 12-16 characters, including uppercase letters, lowercase letters, special characters, and numbers. For more information, see Resetting Instance Password.
   • Delete unused CVM login accounts.
   • Change the default sshd port 22 to a less common port between 1024-65525. For more information, see Modifying the Default Remote Port of CVM.
   • Manage the associated security group rules to open only ports and protocols required by your business. For more information, see Adding Security Group Rules.
   • Close the port for internet access for core applications such as MySQL and Redis databases.
   • Install security software (such as CWP agent), and configure real-time alarms to get notices about suspicious logins instantly.