documentation_complete: true

title: 'Set Lockouts for Failed Password Attempts'

description: |-
    The <tt>pam_faillock</tt> PAM module provides the capability to
    lock out user accounts after a number of failed login attempts. Its
    documentation is available in
    <tt>/usr/share/doc/pam-VERSION/txts/README.pam_faillock</tt>.
    <br /><br />

warnings:
    - general: |-
        Locking out user accounts presents the
        risk of a denial-of-service attack. The lockout policy
        must weigh whether the risk of such a
        denial-of-service attack outweighs the benefits of thwarting
        password guessing attacks.

platform: system_with_kernel
