Linux用户被锁定：pam_tally2(sshd:auth): user **** (501) tally 278, deny 5

问题描述：

早上起来登录服务器，发现普通用户输入密码后，显示服务器拒绝您的请求

排查过程：

1. 连接硬件服务器，显示器。键盘鼠标，登录root排查问题

2. 排查/var/log/secure日志，发现如下错误

Oct 22 11:30:27 XFXT-APP sshd[12534]: Failed password for invalid user Likun from 192.168.223.111 port 12345 ssh2
Oct 22 11:30:28 XFXT-APP sshd[12534]: error: Received disconnect from 192.168.223.111 port 12345:3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Oct 22 11:30:28 XFXT-APP sshd[12534]: Disconnected from invalid user Likun 192.168.223.111 port 12345 [preauth]
Oct 22 11:32:10 XFXT-APP sshd[20911]: pam_tally2(sshd:auth): user Likun (501) tally 278, deny 5
Oct 22 11:32:12 XFXT-APP sshd[20911]: Failed password for Likun from 192.168.223.222 port 12345 ssh2
Oct 22 11:32:29 XFXT-APP sshd[20911]: pam_tally2(sshd:auth): user Likun (501) tally 279, deny 5
Oct 22 11:32:30 XFXT-APP sshd[20911]: Failed password for Likun from 192.168.223.222 port 12345 ssh2
Oct 22 11:32:32 XFXT-APP sshd[20911]: error: Received disconnect from 192.168.223.222 port 12345:3: com.jcraft.jsch.JSchException: \\345\\217\\226\\346\\266\\210\\347\\231\\273\\345\\275\\225\\350\\256\\244\\350\\257\\201 [preauth]
Oct 22 11:32:32 XFXT-APP sshd[20911]: Disconnected from authenticating user Likun 192.168.223.222 port 12345 [preauth]

3. 从日志中发现pam_tally2报出：用户Likun多次登录服务器失败。

4. 查看pam模块关于pam_tally2的限制，在cat /etc/pam.d/password-auth文件中找到了如下设置

5. 在上图中， 查看到普通用户和root用户最大登录失败数是5，那么我们手动解锁Likun账户

pam_tally2 -u Likun -r

6. 也可等待900秒后恢复