How to Use the Command 'faillock' (with Examples)

The faillock command is a powerful utility used for managing authentication failure records on Linux systems. It allows system administrators to review and modify records related to failed login attempts, enabling better security insight and management. By providing details about failed authentication attempts, administrators can identify potential security threats or user issues. This command can be especially useful in environments where tracking user authentication failures is crucial for ensuring system security.

Use Case 1: List Login Failures of the Current User

Code:

faillock

Motivation: Monitoring login failures is crucial for understanding potential unauthorized access attempts. By listing the login failures for the current user, a user or system administrator can identify patterns or potential issues that might require further investigation. This can also help users figure out if they have mistyped their password or if there are suspicious activities on their accounts.

Explanation:

• faillock: Invoking faillock without any options or arguments defaults to displaying the current user’s failed login attempts. The command checks for any failed attempts and displays relevant information like the number and time of failures.

Example Output:

user       2023-10-15 10:32:44     1
user       2023-10-15 10:33:47     2

Use Case 2: Reset the Failure Records of the Current User

Code:

faillock --reset

Motivation: Resetting login failure records for a user’s account is an essential maintenance task. After identifying and resolving the issue causing the failed attempts—whether it’s an honest mistake by the user or a resolved security concern—it is advisable to clear these records to avoid unnecessary lockouts in future.

Explanation:

• faillock: Again, this targets the user’s login failure records by default.
• --reset: This option clears the failure record history of the current user, removing all the stored records related to failed login attempts for the account.

Example Output: There is no output from this command when it operates successfully, but the failure log for the user will be empty upon running faillock again.

Use Case 3: List Login Failures of All Users

Code:

sudo faillock

Motivation: In shared systems, tracking login failures for all users can help an administrator oversee potential security breaches or patterns of incorrect login attempts across the system. It serves as a diagnostic tool to take preventive measures or to assist users who might have forgotten their passwords.

Explanation:

• sudo: Running faillock with superuser privileges (sudo) grants access to view the failure records of all users on the system. This is essential as regular users typically cannot access other users’ login failure data.
• faillock: Used without options, it now lists all users’ failed login attempts, as opposed to just the current user.

Example Output:

admin      2023-10-15 10:32:44     3
john       2023-10-15 10:33:47     1
alice      2023-10-15 10:34:09     2

Use Case 4: List Login Failures of the Specified User

Code:

sudo faillock --user user

Motivation: When a specific user reports issues with logging in or you suspect a particular account is targeted for unauthorized access, listing failures for that specific user allows focused investigation. It narrows down the data to just one user’s records, making it easier to interpret and act upon.

Explanation:

• sudo: Required to access the records of the specified user, ensuring privacy and security.
• faillock: Core command being used to interact with the failure records.
• --user user: Replace user with the actual username whose records you want to query. This option specifies the target for the failure list.

Example Output:

user       2023-10-15 10:35:12     1
user       2023-10-15 10:40:17     2

Use Case 5: Reset the Failure Records of the Specified User

Code:

sudo faillock --user user --reset

Motivation: Resetting the failure records for a specified user is useful after addressing login issues or clearing any false alarms of unauthorized access. It prevents future lockouts and maintains the clarity of current system logs.

Explanation:

• sudo: Needed for sufficient privileges to alter records for users other than the current one.
• faillock: Manages the history of login failures.
• --user user: Indicates which user’s failure records to target for resetting.
• --reset: Clears the failure history of the specified user, helping clean the slate for new login attempts.

Example Output: No visible output is expected. The effect of this command is verified by reviewing the user’s log again and finding no records of any prior attempts.

Conclusion:

The faillock command is an invaluable tool for managing authentication attempts and security. By using its various options, administrators and users can maintain better control over login activities, enhancing the overall security of the system. Whether you are viewing, resetting, or administering access, understanding and utilizing faillock ensures proactive management of login failures.