unlock_time=600 option is invalid in pam-0.77-65.1. You have to download latest PAM version. Otherwise you can write crontab for unlocking after 30 minutes by seeing faillog output. Ex: using awk and crontab you can do this faillog | grep -v Username | awk '$2>5{system("printf "$1":"$2":; date +%s -d \""$5" "$6" "$7"\"")}' | \ awk -F: '1800 < (systime()-$3){print $1; print "User "$1" no longer locked-out: "strftime("%D-%H:%M:%S") >> "/var/log/faillog clear"}' | \ xargs -i faillog -u {} -r Let me know if it helps for you. Regards, Vasu <div class="gmail_quote">On Mon, Jun 16, 2008 at 3:34 PM, Vasudeva R <<a href="mailto:rachamad@gmail.com">rachamad@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="gmail_quote"> Hi Monu, Try with following lines. It is working for me without any problem. auth required pam_tally.so onerr=fail no_magic_root account required pam_tally.so per_user deny=5 no_magic_root reset Let me know. Regards, Vasudeva <h1>RE: pam_tally: unknown option</h1> <hr> <ul><li>From: "Monu Agrawal" <monuindia gmail com></li><li>To: pam-list redhat com</li><li>Subject: RE: pam_tally: unknown option</li><li>Date: Tue, 17 Jun 2008 00:43:57 +0530</li> </ul> <hr> Thanks Joe, but as per documents, deny and unlock_time are auth options, not thee account options. When I changed the config as you mentioned: account required pam_tally.so deny=2 the error "unknown option deny" stopped coming but it didn't make any difference in the time it waits after wrong passwd, even if I make it 20. The version, I can't change because of some dependency reasons. </div> -- Regards, Vasudeva R Alternate mail id: <a href="mailto:rvasu_deva@hotmail.com" target="_blank">rvasu_deva@hotmail.com</a> </blockquote></div>