Suspend Linux OS account on wrong password with pam_tally2

Add following lines on /etc/pam.d/password-auth. Following line should be the added on the beginning of auth section.

auth       required      pam_tally2.so  file=/var/log/tallylog deny=1 onerr=fail even_deny_root lock_time=600

Add following lines on /etc/pam.d/password-auth at the beginning of account section.

account  required     pam_tally2.so

In this section:

file=/var/log/tallylog Default log file is used to keep login counts.
deny=1 Deny access after 1 attempt and lock down user.
onerr=fail if Something wired happend return fail to login
even_deny_root Policy is also apply to root user.
lock_time=600 Account will be locked for 10 Min

Now try with the wrong password on the server.

The user is suspended for 10 min after first failed login. Verify the status of the user with following command.

pam_tally2 -u <username>  

Try login with the correct password to verify that user is actually suspended.

Reset the user status with following command. This command will unsuspended the account specified.

pam_tally2 -u oracle -r

Now attempt login with the correct password. Message will be displayed regarding the user suspended due to failed login attempt.