The error “Account locked due to XXX failed logins” appears before I enter the login password.
This issue may be caused by the
pam_tally2.so configuration in
/etc/pam.d/login file. For VNC login,
/etc/pam.d/login is called for authentication, while
pam_tally2.so indicates to automatically lock the user account temporarily or permanently after the specified number of consecutive failed logins. When an account is permanently locked, you need to unlock it manually.
The login account will be locked when the number of consecutive failed logins exceeds the configured value. Note that the account may also be locked for brute force attacks.
See below for the parameters of
|Lock the account if the number of consecutive failed logins exceeds
|Lock the account for
n seconds when the number of consecutive failed logins exceeds the limit
|Unlock the account automatically
n seconds later
|Do not use
.fail_locktime field in
|If the module is invoked by a root user (uid=0), the counter is not incremented.
|The root user will be locked after
deny=n consecutive failed logins.
|This parameter is required if
even_deny_root is configured. It indicates how long the the root user is locked when the number of consecutive failed logins exceeds the limit.
- Refer to troubleshooting procedure to access the login configuration file and temporarily comment out the configuration of the
- Find the reason why your account is locked, and improve your security policy.
- Try to log in to Linux CVM via SSH key.
- If the login succeeded, proceed to the next step.
- If the login failed, try the single user mode.
- Run the following command to view logs.
This file records the security information, mostly CVM login logs. You can check the error logs of
pam_tally2 as shown below.
- Run the following commands in sequence to open
/etc/pam.d directory and search for
If the result similar to the following figure is returned,
find . | xargs grep -ri "pam_tally2" -l
pam_tally2 is included in
- Run the following command to temporarily comment out the
pam_tally2.so configurations. Then you can log in normally.
sed -i "s/.*pam_tally.*/#&/" /etc/pam.d/login
- Check whether the account is locked due to misoperations or brute force attacks. In the later case, it is recommended to strengthen the security policy as follows:
- Change the CVM password to a stronger password containing 12-16 characters, including uppercase letters, lowercase letters, special characters, and numbers. For more information, see Resetting Instance Password.
- Delete unused CVM login accounts.
- Change the default sshd port 22 to a less common port between 1024-65525. For more information, see Modifying the Default Remote Port of CVM.
- Manage the associated security group rules to open only ports and protocols required by your business. For more information, see Adding Security Group Rules.
- Close the port for internet access for core applications such as MySQL and Redis databases.
- Install security software (such as CWP agent), and configure real-time alarms to get notices about suspicious logins instantly.