<html><body><div>Hi Tomas,</div><div><br></div><div>Thanks for your response.</div><div><br></div><div>On Jun 06, 2013, at 09:28 AM, Tomas Mraz <tmraz@redhat.com> wrote:<br><br></div><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch">This is not correct, the third pam_faillock line would never be called<br> as the second line will always fail. So you can remove it.</div></div></blockquote><span> </span></div><div>I see what you're saying, is this because [default=die] causes all return codes to act as though an error happened? But why does the pam_faillock man page say to place the lines in this way? Even more important why can I login successfully with that configuration? Shouldn't I fail to login all the time?</div><div><br></div><div>I was under the impression that one of the lines has a success type function and the other one has a failure type function.</div><div><br></div><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch"> And just add<br> account required pam_faillock.so<br> line to the beginning of account section. Otherwise the fail count will<br> never be reset on successful authentication.</div></div></blockquote><span> </span></div><div>I have removed the 3rd line, and I have placed the account line at the beginning of the account section. For some reason now, faillock does not increment new failures for my users. Any ideas?</div><div><div><pre data-mce-style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap;" style="font-family: Helvetica, Arial, sans-serif; white-space: pre-wrap;">Bryan</pre></div></div></body></html>