Linux有一个pam_tally2.so的PAM模块，来限定用户的登录失败次数，如果次数达到设置的阈值，则锁定用户。
编译PAM的配置文件
#vim/etc/pam.d/login
#%PAM-1.0authrequiredpam_tally2.sodeny=3lock_time=300even_deny_rootroot_unlock_time=10auth[user_unknown=ignoresuccess=okignoreignore=ignoredefault=bad]pam_securetty.soauthincludesystem-authaccountrequiredpam_nologin.soaccountincludesystem-authpasswordincludesystem-auth#pam_selinux.socloseshouldbethefirstsessionrulesessionrequiredpam_selinux.soclosesessionoptionalpam_keyinit.soforcerevokesessionrequiredpam_loginuid.sosessionincludesystem-authsessionoptionalpam_console.so#pam_selinux.soopenshouldonlybefollowedbysessionstobeexecutedintheusercontextsessionrequiredpam_selinux.soopen