= pam on ubuntu 

#> cat /etc/pam.d/common-auth 

auth required pam_tally.so per_user magic_root onerr=fail deny=5 audit even_deny_root_account
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config


#> cat /etc/pam.d/sshd 
 User unknown in local recipient table
 # PAM configuration for the Secure Shell service

 # Read environment variables from /etc/environment and
 # /etc/security/pam_env.conf.
 auth       required     pam_env.so # [1]
 # In Debian 4.0 (etch), locale-related environment variables were moved to
 # /etc/default/locale, so read that as well.
 auth       required     pam_env.so envfile=/etc/default/locale

 # Standard Un*x authentication.
 auth required pam_tally.so per_user onerr=fail deny=5 audit even_deny_root_account
 @include common-auth

 # Disallow non-root logins when /etc/nologin exists.
 account    required     pam_nologin.so

 # Uncomment and edit /etc/security/access.conf if you need to set complex
 # access limits that are hard to express in sshd_config.
 # account  required     pam_access.so

 # Standard Un*x authorization.
 @include common-account

 # Standard Un*x session setup and teardown.
 @include common-session

 # Print the message of the day upon successful login.
 session    optional     pam_motd.so # [1]

 # Print the status of the user's mailbox upon successful login.
 session    optional     pam_mail.so standard noenv # [1]

 # Set up user limits from /etc/security/limits.conf.
 session    required     pam_limits.so

 # Set up SELinux capabilities (need modified pam)
 # session  required     pam_selinux.so multiple

 # Standard Un*x password updating.
 @include common-password


 #> vi /etc/ssh/sshd_config 
 ChallengeResponseAuthentication yes



/etc/rc.d/init.d/sshd stop
/etc/rc.d/init.d/sshd start

pam_tally --user test --reset=0

watch "faillog -u test"






= pam on centos

#> /etc/pam.d/system-auth
auth required pam_tally.so per_user magic_root onerr=fail deny=5 audit even_deny_root_account

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

[root@leostream cron.daily]# cat /etc/pam.d/sshd 
#%PAM-1.0
auth required pam_tally.so per_user onerr=fail deny=5 audit even_deny_root_account
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    required     pam_loginuid.so

#> vi /etc/ssh/sshd_config 
ChallengeResponseAuthentication yes