Issue

• pam_tally functionality is not working correctly with sudo.

• When pam_tally is used, a valid authentication through sudo still generates a failed login for faillog.

• Configure /etc/pam.d/system-auth to lockout an user after 5 failed login attempts as below :

    auth        required      pam_tally.so onerr=fail deny=5

• Now run sudo,

# sudo pwd
    Password: *** <---Give the correct password of user.
    /home/test

• The command issued to sudo DOES execute successfully. But it generates a failed login message in /var/log/secure

    example.com sudo:     test : TTY=pts/4 ; PWD=/home/test ; USER=root ; COMMAND=/bin/pwd
    example.com sudo: pam_tally(sudo:setcred): Tally underflowed for user root

• And faillog generates the following output:

# faillog -u test
    Login       Failures Maximum Latest                   On
    test            1        0   01/25/10 13:03:01 +0530  /dev/pts/4