Account lockout and password quality on Linux with pam_faillock and pwquality

Goal

Configure a failed-login lockout threshold and a minimum password-quality policy, inspect and clear lockouts, and apply the change through the correct front end for the distribution family.

Prerequisites

Root privileges; pam_faillock (part of the PAM stack on RHEL-family and Debian/Ubuntu systems) and libpwquality/pam_pwquality installed.

Steps

1. Edit lockout thresholds in /etc/security/faillock.conf, not in the PAM files directly: e.g. deny = 4 and unlock_time = 1200. The pam_faillock manual page uses this pair in its example to lock an account "after 4 consecutive failed logins" and unlock it "after 20 minutes." By default root is not locked; that needs even_deny_root. The default tally directory /var/run/faillock is usually on tmpfs, so lock records are cleared by a reboot.
2. Edit password-quality thresholds in /etc/security/pwquality.conf: e.g. minlen = 12. minlen interacts with the *credit settings, so read pam_pwquality's description of it before choosing a value. Drop-ins in /etc/security/pwquality.conf.d/*.conf are read first, so the same setting left uncommented in pwquality.conf overrides them. Checks apply only to password changes; root can still set a weak password unless enforce_for_root is set.
3. On RHEL 8 and later, check the active profile with authselect current, then add lockout to it with authselect enable-feature with-faillock rather than editing /etc/pam.d by hand. authselect select <profile> ... replaces the whole feature list, and on a host not yet managed by authselect it needs --force, which overwrites the existing PAM files (a backup is made under /var/lib/authselect/backups). The authselect profiles already include pam_pwquality.
4. On Debian/Ubuntu, installing libpam-pwquality registers its profile with pam-auth-update. Check /usr/share/pam-configs/ for a faillock profile; if none is installed, write a local profile there and enable it with pam-auth-update --enable <name> (non-interactive) instead of hand-editing /etc/pam.d/common-auth. --package is meant for maintainer scripts, not administrators.
5. Inspect a specific user's failure count: faillock --user alice, which reads the per-user tally files the faillock command is built to examine.
6. Clear a lockout: faillock --user alice --reset.

Expected result

After deny consecutive failures, further attempts are refused until unlock_time elapses or an administrator resets the counter; faillock --user <name> shows the current failure count and timestamps before and after a reset.

Limits and test basis

Locking yourself out during testing is the main risk: test lockout settings against a non-privileged test account first, and keep an out-of-band (console or existing session) path to run faillock --user <name> --reset if the account being tested locks. To undo, restore the previous faillock.conf/pwquality.conf values (they take effect at the next authentication), and reverse the PAM change with authselect disable-feature with-faillock or authselect backup-restore <name>, or pam-auth-update --disable <name>. None of this requires a reboot, and an already-open session is not retroactively affected.