The meaning of the Valid field in the faillock(8) command output

Solution Verified - Updated -

Issue

When the faillock(8) command is executed with --user argument to examine a particular user's tally records it can output the so-called Valid field for each tally record. The meaning of this field is not clearly explained in the documentation.

# faillock --user testuser
testuser:
When                Type  Source                                           Valid
2022-05-16 17:36:22 RHOST 10.76.1.137                                          V
2022-05-16 17:36:24 RHOST 10.76.1.137                                          V
2022-05-16 17:36:28 RHOST 10.76.1.137                                          V

Resolution

The Valid field simply reflects the current status of a tally record. For example, if a failure recorded falls outside the configured fail interval (see faillock.conf(5) fail_interval) it would no longer be counted making related tally record invalid. Another case would be when an account was just unlocked so any tally records prior to that become invalid. The validity of a tally record is indicated with V for valid and I for invalid and its meaning is always in the context of the current configuration and state.

  • Component
  • pam

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments