The explanation seems to be that pam_tally2 records a failed login when
login command is started, even before a password is entered. Normally, the
failed logins counter is reset when the user enters the correct password.
For login this works correctly when the following line is added in pam
auth required pam_tally2.so file=/var/log/tallylog deny=5 even_deny_root
However, when using sudo, the counter only gets reset when the following
line is added to pam configuration (common-account):
account required pam_tally2.so
Why is the behaviour different for login and sudo?
Is this a bug?
I think this is a bit confusing and it might be good to explain it in more
detail on the man page (and the examples section).
Pam-list mailing list