Mastering Linux Security and Hardening - Second Edition

Configuring the pam_tally2 PAM 

To make this magic work, we'll rely on our good friend, the PAM. The pam_tally2 module comes already installed on both CentOS and Ubuntu, but it isn't configured. For both of our virtual machines, we'll be editing the /etc/pam.d/login file. Figuring out how to configure it is easy because there's an example at the bottom of the pam_tally2 man page:

EXAMPLES Add the following line to /etc/pam.d/login to lock the account after4 failed logins. Root account will be locked as well. The accounts will beautomatically unlocked after 20 minutes. The module does not have to becalled in the account phase because the login calls pam_setcred(3)correctly. auth required pam_securetty.so auth required pam_tally2.so deny=4 ...